Xakerlar Ivanti Connect Secure (ICS) VPN qurilmalaridagi nol kunlik zaifliklar zanjirini ishlatib, root huquqlari bilan buyruqlarni bajarish, ma'lumotlarni o'g'irlash va ichki tarmoqlarni tekshirish imkoniyatiga ega bo'lishdi.
Volexity noma'lum hujumchini UTA0576 deb aniqladi va ekspluatatsiyani 2026-yil 3-oktabrga qadar kuzatib bordi, bu vaqtda to'liq yangilangan qurilma nishonga olingan.
29-oktabrdagi maslahat yangilanishida Ivanti hujumlarda ishtirok etgan uchta zaiflikni aniqladi: CVE-2026-104935, CVE-2026-111357 va CVE-2026-118527. Kompaniya ekspluatatsiya cheklangan miqdordagi mijozlarga ta'sir qilganini va qolgan zaifliklarni bartaraf etish uchun qo'shimcha yamalar chiqarilganini ma'lum qildi.
Tergov avvalroq xabar qilingan Ivanti VPN nol kunlik ekspluatatsiya zanjirini kengaytiradi, bu zanjir autentifikatsiyani chetlab o'tish, zararli faylni bajarish va haqiqiy ma'lumotlarsiz huquqlarni oshirishni birlashtirgan.
Volexity 5-oktabrda shubhali faoliyatni tekshirishni boshladi va 22.8R2.4 versiyasi, 19097 qurilish raqamidagi ICS qurilmasini kirish manbai sifatida aniqladi.
Dastlabki chetlab o'tish qurilmaning ommaviy kirish nuqtasi va orqa tomon CGI yo'naltirish o'rtasidagi so'rovlarni qayta ishlashdagi nomuvofiqlikdan foydalangan. Hujumchilar welcome.cgi ga so'rov yuborib, yo'naltirish sarlavhasini manipulyatsiya qilib, autentifikatsiyasiz himoyalangan CGI skriptlariga kirishgan.
Keyin UTA0576 wu.cgi yuklash ishlovchisidan foydalanib, yuklangan mazmunni diskka yozib, uning haqiqiy ZIP arxivi ekanligini tekshirishdan oldin saqlagan. Zararli Perl skripti qisqa muddatda o'chirilishidan oldin kirish mumkin bo'lgan.
Parallel so'rovlar bu vaqt oynasidan foydalanib, yuklangan skriptni cgi-server hisob qaydnomasi ostida bajargan. Keyingi Python bosqichi esa imtiyozli dsinvoked xizmatiga qaratilgan.
Bu xizmat DSCache'da saqlanadigan texnik xizmat vazifalari konfiguratsiyasiga ishonardi. Xotiradagi kutubxonani vaqtincha o'zgartirib va texnik xizmat vazifasini qayta yo'naltirib, hujumchi zararli kodni root huquqlari bilan bajargan. Yuklama keyinchalik o'zgartirilgan konfiguratsiya va xotira holatini tiklagan.
Ivanti dastlab autentifikatsiyani chetlab o'tish va masofadan bajarishni CVE-2026-104935, CVSS 8.6 deb kuzatgan. Oktyabr yangilanishi huquqlarni oshirishni CVE-2026-111357, CVSS 8.8 va oldindan aytib bo'ladigan fayl nomlari bilan fayl yuklashni CVE-2026-118527, CVSS 4.3 deb belgilaydi.
Nazoratni qo'lga kiritgandan so'ng, UTA0576 qurilma ma'lumotlarini chiqarib olgan va Active Directory xizmat hisob qaydnomasidan foydalanib, sezgir katalog ma'lumotlarini so'ragan. Nishonlar Windows LAPS administrator parollari, BitLocker tiklash kalitlari, parol saqlovchi atributlar va hisob qaydnomasi metama'lumotlarini o'z ichiga olgan.
Maxsus Python yordamchi dasturlari LDAP so'rovlarini va Kerberos ma'lumotlarini tekshirishni qo'llab-quvvatlagan. Tergovchilar shuningdek parol purkash, ichki DNS tekshiruvi, autentifikatsiya jurnallarini tekshirish va ma'lumot yoki autentifikatsiya materialini tiklashga qaratilgan paket tahlilini kuzatgan.
Avvalgi Ivanti hujumlaridan farqli o'laroq, bu operatsiya DslogdRAT va veb qobiqlarni joylashtirmagan, bu operatsiya joylashtirilgan veb qobiq yoki doimiy orqa eshikdan foydalanmagan. Buyruqlar va natijalar takroriy ekspluatatsiya bilan bog'liq HTTPS so'rovlari orqali o'tgan.
Ko'plab vositalar va ekspluatatsiya zanjiri komponentlari xotiradan tiklanishi mumkin (Manba: volexity)
UTA0576 Ivanti nosozlik jurnallari va Linux audit jurnallaridan dalillarni tanlab o'chirgan. Faqat xotirada o'zgartirishlar va keyinchalik konfiguratsiya ma'lumotlarini tiklash disk asosidagi yaxlitlik tekshiruvlarining foydaliligini cheklagan.
29-oktabr yangilanishi 25.1.1.3 va 22.8R2.6 versiyalarini e'lon qilingan zaifliklarni bartaraf etuvchi deb ko'rsatadi. Tashkilotlar Ivanti xavfsizlik maslahatidagi tegishli yangilash yo'lini kuzatishi, apparat va joylashtirish talablarini hisobga olishi kerak.
Administratorlar shubhali qurilma faoliyatini tekshirishi, ochiq xizmat hisob qaydnomasi ma'lumotlarini baholashi va mumkin bo'lgan yon harakatni tekshirishi kerak. Toza yaxlitlik tekshiruvi natijasi faqatgina buzilishni istisno qilmaydi; xotira tasvirlari, disk tasvirlari va ekspluatatsiya bilan bog'liq yadro to'kilmalari bu kirishni qayta tiklashda muhim bo'lgan.
Volexity kuzatilgan ma'lumot o'g'irlash va tekshiruv kengroq tarmoq buzilishiga tayyorgarlikni ko'rsatganini baholagan. Biroq, tergovchilar operatsiyani to'xtatishdan oldin hujumchining yakuniy maqsadlarini aniqlay olmagan.
SOCingizga hodisalarni tez to'xtatish uchun ogohlantirish kontekstini bering.16K SOCdan tahdid razvedkasini integratsiya qiling.
Hackers exploited a chain of zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances, allowing them to execute commands with root access, steal credentials, and probe internal networks.
Volexity has identified the unknown attacker as UTA0576 and traced the exploitation back to October 3, 2026, targeting an appliance that was fully patched at the time.
In an advisory update on October 29, Ivanti identified three vulnerabilities involved in the attacks: CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527. The company reported that the exploitation affected a limited number of customers and released additional patches to address the remaining weaknesses.
The investigation expands on the previously reported Ivanti VPN zero-day exploitation chain, which combined authentication bypass, malicious file execution, and privilege escalation without requiring valid credentials.
Volexity began investigating suspicious activity on October 5 and identified an ICS appliance running version 22.8R2.4, Build 19097, as the source of the intrusion.
The initial bypass exploited inconsistent request handling between the appliance’s public login endpoint and its backend CGI routing. Attackers submitted requests to welcome.cgi while manipulating a routing header to reach protected CGI scripts without authentication.
Next, UTA0576 abused the wu.cgi upload handler, which wrote uploaded content to disk before validating whether it was a legitimate ZIP archive. A malicious Perl script briefly remained accessible before deletion.
Parallel requests exploited this timing window to execute the uploaded script under the cgi-server account. A subsequent Python stage then targeted the privileged dsinvoked service.
That service trusted maintenance-task configuration stored in DSCache. By temporarily modifying an in-memory library and redirecting a maintenance task, the attacker executed malicious code with root privileges. The payload subsequently restored the altered configuration and memory state.
Ivanti initially tracked the authentication bypass and remote execution under CVE-2026-104935, rated CVSS 8.6. The October update assigns CVE-2026-111357, rated 8.8, to privilege escalation and CVE-2026-118527, rated 4.3, to predictable-filename file uploads.
After gaining control, UTA0576 extracted appliance credentials and used an Active Directory service account to query sensitive directory information. Targets included Windows LAPS administrator passwords, BitLocker recovery keys, password-bearing attributes, and account metadata.
Custom Python utilities supported LDAP queries and Kerberos credential testing. Investigators also observed password spraying, internal DNS reconnaissance, authentication-log inspection, and packet-capture analysis aimed at recovering credentials or authentication material.
Unlike earlier Ivanti attacks deploying DslogdRAT and web shells, this operation did not rely on a deployed web shell or persistent backdoor. Commands and results traveled through HTTPS requests associated with repeated exploitation.
many of the tools and exploit chain components are recoverable from memory (Source: volexity)
UTA0576 selectively removed evidence from Ivanti debug logs and Linux audit logs. Memory-only modifications and subsequent restoration of configuration data also limited the usefulness of disk-based integrity checks.
The October 29 update lists versions 25.1.1.3 and 22.8R2.6 as resolving the disclosed vulnerabilities. Organizations should follow the applicable upgrade path in Ivanti’s security advisory, accounting for hardware and deployment requirements.
Administrators should investigate suspicious appliance activity, assess exposed service-account credentials, and examine potential lateral movement. A clean integrity-check result alone does not exclude compromise; memory captures, disk images, and exploitation-related core dumps proved essential to reconstructing this intrusion.
Volexity assessed that the observed credential theft and reconnaissance indicated preparation for broader network compromise. However, investigators could not determine the attacker’s ultimate objectives before disrupting the operation.
Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.
