Monday briefing: Persistent backdoors on Ivanti VPNs still fueling ransomware intrusions, rebuilds urged

Security teams returning on Monday should assume risk from Ivanti Connect Secure and Policy Secure VPN appliances that were exposed during the winter and spring exploitation waves. Multiple incident response firms report ongoing ransomware deployments traced to backdoors planted during exploitation of CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893 across North America and Europe.

This matters because attackers used those bugs to modify system files and install persistence that survives ordinary updates. Ivanti and CISA previously told customers to perform full rebuilds from clean media, not only patch, since integrity on compromised appliances could not be guaranteed.

Why this matters now

Clusters tracked as UNC5221 and other financially motivated groups used the flaws to drop web shells, implant unauthorized SSH keys, and create scheduled tasks on the appliances. Several ransomware crews later leveraged the same footholds for lateral movement into Windows and VMware ESXi environments.

Organizations that only applied hotfixes or version upgrades without a factory reset remain at risk. Web shells and rogue accounts on the VPN can enable Monday morning payload deployment without fresh perimeter alerts.

Action for defenders

If you operate Ivanti Connect Secure or Policy Secure and were exposed during the vulnerable windows, rebuild the appliance to a trusted image and then apply current releases. Run Ivanti’s Integrity Checker Tool on any device that has not been rebuilt, but do not rely on tool output alone to declare the system clean.

After rebuild, rotate all VPN device credentials, SAML secrets, and API keys. Reissue VPN and management certificates. Remove any unknown local admin accounts and SSH keys. Audit for persistence, including cron jobs, init scripts, modified authorized keys, and nonstandard binaries under data and temp directories on the appliance.

Hunt for lateral movement tied to the appliance’s service account or VPN user activity. Review authentication logs for suspicious new MFA enrollments, off hours logins, and token reuse. Check endpoints for common post exploitation utilities, including remote administration tools abused by ransomware affiliates.

Restrict management interfaces to trusted networks, enforce MFA for all remote access, and monitor for new additions to CISA’s Known Exploited Vulnerabilities catalog. Apply the same scrutiny to other edge appliances with a history of mass exploitation, including Palo Alto GlobalProtect and Citrix NetScaler.

The persistence problem on network edge gear underscores a broader shift in enterprise risk. Appliances that lack robust telemetry and secure recovery paths create long lived blind spots, which strengthens the case for designs that favor verifiable rebuilds, centralized identity, and granular remote access controls.