Monday briefing: Active exploits keep targeting Ivanti VPNs, ScreenConnect, and Palo Alto GlobalProtect for ransomware entry
Marcus Webb ·
Ransomware affiliates and initial access brokers continue to abuse unpatched Ivanti Connect Secure VPNs, ConnectWise ScreenConnect servers, and Palo Alto Networks GlobalProtect gateways to gain footholds that often lead to data theft and encryption early in the workweek. The activity centers on publicly known, widely exploited flaws including CVE-2023-46805 with CVE-2024-21887 and CVE-2024-21893 in Ivanti, CVE-2024-1709 in ScreenConnect, and CVE-2024-3400 in PAN OS.
This matters on Monday because intrusions staged over the weekend frequently pivot to domain compromise when staff return and authentication noise resumes. Patching after an exposure does not evict an intruder, so teams should validate both remediation and incident response steps today.
Affected products and key indicators
Ivanti Connect Secure and Policy Secure appliances were hit by authentication bypass and command injection chains that enabled device takeover. Defenders should confirm upgrades to vendor fixed builds, then hunt for unauthorized admin accounts, modified XML configs, unexpected processes, or files under temporary and web directories. If compromise is suspected, follow Ivanti guidance to perform an appliance factory reset or rebuild, then reissue certificates and rotate all credentials integrated with the device.
ConnectWise ScreenConnect servers vulnerable to CVE-2024-1709 allowed unauthenticated admin creation. Verify the server is on 23.9.8 or later, review audit logs for new users and changed authentication providers, check for unknown extensions, and remove any persistence such as scheduled tasks or added remote tools. Rotate API keys and service credentials that may have been exposed.
Palo Alto Networks GlobalProtect gateways affected by CVE-2024-3400 enabled command execution on the firewall. Apply the vendor hotfix releases for the affected PAN OS trains, review system logs for unusual command invocations by the web backend, inspect for new files or scripts on the device, and restrict management access to trusted networks. Assume device level compromise if indicators are present and follow the vendor’s recovery steps.
What defenders should do today
Validate versions and configurations against vendor advisories for each CVE, and confirm compensating controls where upgrades are pending.
Hunt for persistence even if patched, including new local or domain admins, startup items, scheduled tasks, webshells, and third party remote management tools.
Rotate credentials and tokens tied to these services, enforce MFA on all admin access, and limit exposure of management interfaces to VPN or allowlisted networks.
Monitor for common exfiltration utilities such as Rclone, 7zip, and cloud storage clients, and test offline and immutable backups.
These device edge flaws continue to blur the line between network and identity. The broader shift is toward hardening internet facing infrastructure, reducing implicit trust, and treating appliance patching and post exploitation hunting as a single workflow rather than separate tasks.