Ivanti Connect Secure Zero-Days Actively Exploited

Summary

Threat actors identified as UTA0178 are actively targeting two zero-day vulnerabilities (CVE-2024-21887 and CVE-2023-46805) found in Ivanti Connect Secure (ICS) VPN appliances. Volexity researchers discovered at least 1,700 devices worldwide have been compromised with the GIFTEDVISITOR webshell backdoor variant. Initially, the attacks were highly targeted and included global government and military departments, national telecommunications companies, defense contractors, aerospace and engineering, and technology; however, non-discriminant exploitation is now widespread. Mandiant has also conducted an analysis of attacks, attributing the activity to a threat actor tracked as UNC5221, with the intent to conduct espionage. Patches are expected to be released in a staggered schedule beginning the week of January 22. Mitigations, workarounds, and recommendations can be found in the Ivanti article.