CISA is releasing this alert to provide cyber defenders with new mitigations to defend against threat actors exploiting Ivanti Connect Secure and Policy Secure Gateways vulnerabilities in Ivanti devices.
Threat actors are continuing to leverage vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways to capture credentials and/or drop webshells that enable further compromise of enterprise networks.
Some threat actors have recently developed workarounds to current mitigations and detection methods and have been able to exploit weaknesses, move laterally, and escalate privileges without detection.
CISA is aware of instances in which sophisticated threat actors have subverted the external integrity checker tool, further minimizing traces of their intrusion.
If an organization has been running Ivanti Connect Secure and Policy Secure gateways over the last several weeks and/or continues to run these products, CISA recommends continuous threat hunting on any systems connected to-or recently connected to-the Ivanti device.
Organizations should monitor authentication, account usage, and identity management services that could be exposed and isolate the system(s) from any enterprise resources as much as possible.
When these become available, CISA recommends that organizations continue to hunt their network in order to detect any compromise that may have occurred before patches were implemented.
This guidance supplements CISA's previous guidance for mitigation and detection, which remains applicable.
This product is provided subject to this Notification and this Privacy & Use policy.
This Cyber News was published on www.cisa.gov. Publication date: Tue, 30 Jan 2024 20:43:05 +0000