The ongoing attacks demonstrate advanced persistent threat techniques, deploying multiple malware families including MDifyLoader, Cobalt Strike Beacon, vshell, and Fscan to establish long-term access to compromised networks. Following initial compromise, the threat actors establish persistence through multiple mechanisms including creating new domain accounts, registering malware as Windows services, and leveraging task scheduler for periodic execution. The attack begins with threat actors gaining initial access through vulnerable Ivanti Connect Secure devices, subsequently deploying a complex infection chain designed to evade detection and maintain persistence. JPCERT/CC Eyes analysts identified the malware campaign’s sophisticated execution methodology, which leverages legitimate system files and DLL side-loading techniques to mask malicious activities. The attackers demonstrate particular attention to operational security, employing multiple layers of obfuscation and encryption to complicate analysis and detection efforts. The loader targets legitimate files such as Java RMI compiler (rmic.exe) and push_detect.exe to establish initial execution, demonstrating the attackers’ preference for living-off-the-land techniques. The primary payload, Cobalt Strike Beacon version 4.5, represents a customized variant that deviates from standard implementations by incorporating RC4 encryption with a hardcoded key “google” instead of the typical one-byte XOR encryption scheme. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. A sophisticated malware campaign targeting Ivanti Connect Secure VPN devices has been actively exploiting critical vulnerabilities CVE-2025-0282 and CVE-2025-22457 since December 2024. The campaign demonstrates sustained activity with attackers conducting brute-force attacks against Active Directory servers, FTP, MSSQL, and SSH services while exploiting the MS17-010 SMB vulnerability for lateral movement across unpatched systems. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. The encryption key derives from the MD5 hash value of the executable file, creating a dependency that complicates isolated analysis.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 18 Jul 2025 13:25:13 +0000