a building featuring Ivanti's logo in red on the top of the building

Hackers begin mass-exploiting Ivanti VPN zero-day flaws

by with No Comment Tech

a building featuring Ivanti's logo in red on the top of the building

Image Credits: Bloomberg / Getty Images

Malicious hackers have begun mass-exploiting two critical zero-day vulnerabilities in Ivanti’s widely used corporate VPN appliance.

That’s according to cybersecurity company Volexity, which first reported last week that China state-backed hackers are exploiting the two unpatched flaws in Ivanti Connect Secure — tracked as CVE-2023-46805 and CVE-2024-21887 — to break into customer networks and steal information. At the time, Ivanti said it was aware of “less than 10 customers” affected by the “zero-day” flaws, described as such given that Ivanti had no time to fix the flaws before they were exploited.

In an updated blog post published on Monday, Volexity says it now has evidence of mass exploitation.

According to Volexity, more than 1,700 Ivanti Connect Secure appliances worldwide have been exploited so far, affecting organizations in the aerospace, banking, defense, government and telecommunications industries.

“Victims are globally distributed and vary greatly in size, from small businesses to some of the largest organizations in the world, including multiple Fortune 500 companies across multiple industry verticals,” said Volexity. The security firm’s researchers added that Ivanti VPN appliances were “indiscriminately targeted,” with corporate victims around the world.

But Volexity notes that the number of compromised organizations is likely to be far higher. Nonprofit security threat tracker Shadowserver Foundation has data showing more than 17,000 internet-visible Ivanti VPN appliances worldwide, including more than 5,000 appliances in the United States.

Ivanti confirmed in its updated advisory on Tuesday that its own findings are “consistent” with Volexity’s new observations and that the mass-hacks appear to have started on January 11, a day after Ivanti disclosed the vulnerabilities. In a statement provided via public relations agency MikeWorldWide, Ivanti told TechCrunch that it has “seen a sharp increase in threat actor activity and security researcher scans.”

When reached Tuesday, Volexity’s spokesperson Kristel Faris told TechCrunch that the security firm is in contact with Ivanti, which is “responding to an increase in support requests as quickly as possible.”

Despite mass exploitation, Ivanti has yet to publish patches. Ivanti said it plans to release fixes on a “staggered” basis starting the week of January 22. In the meantime, admins are advised to apply mitigation measures provided by Ivanti on all affected VPN appliances on their network. Ivanti recommends admins reset passwords and API keys, and revoke and reissue any certificates stored on the affected appliances.

No ransomware… yet

Volexity initially attributed exploitation of the two Ivanti zero-days to a China-backed hacking group it tracks as UTA0178. Volexity said it had evidence of exploitation as early as December 3.

Mandiant, which is also tracking exploitation of the Ivanti vulnerabilities, said it has not linked the exploitation to a previously known hacking group, but said its findings — combined with Volexity’s — leads Mandiant to attribute the hacks to “an espionage-motivated APT campaign,” suggesting government-backed involvement.

Volexity said this week that it has seen additional hacking groups — specifically a group it calls UTA0188 — exploit the flaws to compromise vulnerable devices, but declined to share additional details about the group — or its motives — when asked by TechCrunch.

Volexity told TechCrunch that it has seen no evidence that ransomware is involved in the mass hacks at this point. “However, we fully anticipate that happening if proof-of-concept code becomes public,” added Faris.

Security researchers have already pointed to the existence of proof-of-concept code capable of exploiting the Ivanti zero-days.

State-backed hackers are exploiting new Ivanti VPN zero-days — but no patches yet

a building featuring Ivanti's logo in red on the top of the building

Researchers say attackers are mass-exploiting new Ivanti VPN flaw

by with No Comment Tech

a building featuring Ivanti's logo in red on the top of the building

Image Credits: Bloomberg / Getty Images

Hackers have begun mass exploiting a third vulnerability affecting Ivanti’s widely used enterprise VPN appliance, new public data shows.

Last week, Ivanti said it had discovered two new security flaws — tracked as CVE-2024-21888 and CVE-2024-21893 — affecting Connect Secure, its remote access VPN solution used by thousands of corporations and large organizations worldwide. According to its website, Ivanti has more than 40,000 customers, including universities, healthcare organizations, and banks, whose technology allows their employees to log in from outside the office.

The disclosure came not long after Ivanti confirmed two earlier bugs in Connect Secure, tracked as CVE-2023-46805 and CVE-2024-21887, which security researchers said China-backed hackers had been exploiting since December to break into customer networks and steal information.

Now data shows that one of the newly discovered flaws — CVE-2024-21893, a server-side request forgery flaw — is being mass exploited.

Although Ivanti has since patched the vulnerabilities, security researchers expect more impact on organizations to come as more hacking groups are exploiting the flaw. Steven Adair, founder of cybersecurity company Volexity, a security company that has been tracking exploitation of the Ivanti vulnerabilities, warned that now that proof-of-concept exploit code is public, “any unpatched devices accessible over the Internet have likely been compromised several times over.”

Piotr Kijewski, chief executive of Shadowserver Foundation, a nonprofit organization that scans and monitors the internet for exploitation, told TechCrunch on Thursday that the organization has observed more than 630 unique IPs attempting to exploit the server-side flaw, which allows attackers to gain access to data on vulnerable devices.

That’s a sharp increase compared to last week when Shadowserver said it had observed 170 unique IPs attempting to exploit the vulnerability.

An analysis of the new server-side flaw shows the bug can be exploited to bypass Ivanti’s original mitigation for the initial exploit chain involving the first two vulnerabilities, effectively rendering those pre-patch mitigations moot.

Kijewski added that Shadowserver is currently observing around 20,800 Ivanti Connect Secure devices exposed to the internet, down from 22,500 last week, though he noted that it isn’t known how many of these Ivanti devices are vulnerable to exploitation.

It’s not clear who is behind the mass exploitation, but security researchers attributed the exploitation of the first two Connect Secure bugs to a China government–backed hacking group likely motivated by espionage.

Ivanti previously said it was aware of “targeted” exploitation of the server-side bug aimed at a “limited number of customers.” Despite repeated requests by TechCrunch this week, Ivanti would not comment on reports that the flaw is undergoing mass exploitation, but it did not dispute Shadowserver’s findings.

Ivanti began releasing patches to customers for all of the vulnerabilities alongside a second set of mitigations earlier this month. However, Ivanti notes in its security advisory — last updated on February 2 — that it is “releasing patches for the highest number of installs first and then continuing in declining order.”

It’s not known when Ivanti will make the patches available to all of its potentially vulnerable customers.

Reports of another Ivanti flaw being mass-exploited come days after the U.S. cybersecurity agency CISA ordered federal agencies to urgently disconnect all Ivanti VPN appliances. The agency’s warning saw CISA give agencies just two days to disconnect appliances, citing the “serious threat” posed by the vulnerabilities under active attack.