Active campaign targets unpatched Ivanti Connect Secure VPNs as midweek detections climb

Multiple security teams reported fresh intrusions on Wednesday linked to unpatched Ivanti Connect Secure and Policy Secure gateways. Adversaries are exploiting the 2024 Ivanti flaws CVE-2023-46805 and CVE-2024-21887 to gain initial access, then pivoting to data theft and ransomware inside enterprise networks.

The activity matters because these vulnerabilities remain on CISA’s Known Exploited Vulnerabilities catalog, and compromised appliances often require a rebuild rather than a routine patch. Organizations that applied interim mitigations in 2024 but never rebuilt are at higher risk of latent persistence.

Researchers continue to attribute early exploitation of the chain to UNC5221, a group assessed as state sponsored, with financially motivated actors later adopting the same path. The initial vector combines an authentication bypass with a command injection to drop web shells and schedule persistent tasks on the appliance.

Post compromise behavior is consistent with standard playbooks. Operators enumerate internal subnets, harvest credentials from downstream resources, and move laterally using RDP and SMB. Several incidents show the use of legitimate remote management tools and on box binaries to minimize noise.

Indicators on the gateways include unexpected cron entries, unknown Perl or Python scripts in temporary or data directories, and modified authentication templates. Administrators also report unexplained outbound connections from the VPN appliances to external IP addresses over high numbered TCP ports, which should be rare in normal operation.

Mitigation begins with confirming software levels. Ivanti issued fixed releases in 2024 that remediate CVE-2023-46805 and CVE-2024-21887. CISA and Ivanti guidance state that defenders should run the Integrity Checker Tool, then perform a factory reset or clean rebuild from a known good image if compromise is suspected, even if patches are present.

After rebuilding, rotate all credentials that may have transited the device. That includes administrator accounts, service accounts, SAML secrets, device certificates, and any OAuth or API tokens associated with downstream identity providers. Enforce phishing resistant multifactor for privileged access and restrict management interfaces to a separate administrative network.

Network controls can reduce blast radius. Egress filter the VPN appliances to only required update and identity endpoints, and alert on any new external destinations. Collect logs from the devices into a SIEM, and monitor for authentication anomalies downstream that originate from VPN address pools.

For the broader technology landscape, the persistence of exploits against network edge appliances underscores that patching alone is not a complete strategy. Vendors and buyers need lifecycle plans for hardened rebuilds, strict egress, and identity oriented controls whenever perimeter devices are in scope for exploitation.