Ransomware crews press unpatched Ivanti VPNs as workweeks start, exploiting CVE-2023-46805 and CVE-2024-21887

Ransomware affiliates are hitting enterprises through unpatched Ivanti Connect Secure and Policy Secure gateways as teams return to work on Monday, according to incident responders tracking weekend activity in North America and Europe. Attackers are chaining CVE-2023-46805, an authentication bypass, with CVE-2024-21887 and related command injection bugs to gain device control, then establishing persistence that often survives reimages.

This matters because the appliances sit at the edge, they bridge into internal networks, and compromise can cascade into domain-wide ransomware deployment within hours. CISA added these CVEs to its Known Exploited Vulnerabilities catalog in 2024, and multiple reports since then show continued exploitation against lagging patch baselines.

What defenders are seeing After initial access via the REST API bugs, intruders commonly drop web shells and backdoors on the appliance, create or elevate local and admin accounts, and modify startup scripts for persistence. From there they pivot into on premises Active Directory, harvest VPN credentials and tokens, and stage encryptors via SMB or RDP.

Responders continue to find implants and cron jobs that reestablish access even after a factory reset. Integrity checker tools on older firmware builds have missed tampering in some cases, so a clean rebuild to a fixed image is required before bringing a device back online.

Actionable steps now If any Ivanti Connect Secure or Policy Secure appliance has not been rebuilt and upgraded to a fixed release since the 2024 advisories, treat it as compromised. Remove it from the network, perform a clean install to a remediated version, and run the latest Ivanti Integrity Checker with current signatures.

Rotate all credentials that may have transited the device, including VPN, service, and domain accounts, and revoke OAuth refresh tokens tied to remote access. Hunt for unauthorized admin users, new or modified cron entries, unexpected binaries under data and temp paths, and outbound connections from the appliance to unknown IPs.

Monitor for post exploitation behavior such as LDAP enumeration from VPN subnets, Kerberoasting attempts, and lateral movement to domain controllers. If rebuilds are not immediately possible, apply interim mitigations from Ivanti advisories, restrict management interfaces by IP, and increase logging on the gateway and downstream identity systems.

Broader context Edge device exploitation has become the most reliable on ramp for both state linked actors and ransomware groups, shifting initial access away from endpoints and toward network appliances that are hard to monitor and patch. Vendors and regulators are pushing secure by default designs for remote access gear, but until appliances provide stronger runtime attestation and isolation, defenders should assume opportunistic targeting of VPN and SD WAN gateways will intensify at the start of each workweek.