Malware hunters at Volexity on Wednesday warned that suspected Chinese nation-state hackers are actively exploiting a pair of unauthenticated remote zero-day vulnerabilities in Ivanti Connect Secure VPN devices.
The vulnerabilities, tracked as CVE-2023-46805 and CVE-2024-21887, affect fully patched Internet-facing Ivanti Connect Secure VPN appliances and were caught during in-the-wild zero-day exploitation.
Ivanti, a company that has struggled with major security problems, released pre-patch mitigations for the new vulnerabilities but said comprehensive fixes will be released on a staggered schedule beginning on January 22.
In a research report, Volexit said it caught the zero-days after noticing suspicious lateral movement on the network of one of its customers, and found that an attacker was placing webshells on multiple internal and external-facing web servers.
The company traced the infections back to the victim company's Ivanti Connect Secure VPN appliance that showed that its logs had been wiped and logging had been disabled.
Volexity said it worked closely with Ivanti in order to obtain disk and memory images from the impacted devices and was able to uncover the exploit chain used by the attacker.
The researchers said they caught the attackers modifying legitimate ICS components and making changes to the system to evade Ivanti's Integrity Checker Tool; and backdooring a legitimate CGI file on the ICS VPN appliance to allow command execution.
This Cyber News was published on www.securityweek.com. Publication date: Wed, 10 Jan 2024 22:13:05 +0000