Multiple Threat Groups Exploiting Ivanti VPN/NAS Zero-Days
Urgent action is required to fix two zero day flaws in Ivanti Connect Secure VPN and Policy Secure NAS appliances. The vulnerabilities were discovered by researchers at Volexity and were disclosed by Avanti last week. While they have been exploited in the wild since December 2023 by an Advanced Persistent Threat group, the attacks have been highly targeted and at the time of the disclosure, fewer than 20 customers had been attacked but the situation has now changed. On January 11, 2023, multiple threat actors started mass exploiting the flaws in indiscriminate attacks on businesses of all sizes across multiple sectors.
Ivanti will be releasing patches to fix the flaws starting in the week of January 22, 2024, and final patches will be released in the week of February 19, 2024; however, there is a workaround that can prevent exploitation of the flaws until the patches are released Any HIPAA-regulated entity that uses one of the vulnerable products should ensure that the workaround is implemented immediately given the extent to which the flaws are being exploited.
The vulnerabilities are CVE-2023-46805, an authentication bypass flaw (CVSS 8.2) that is present in of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure, and CVE-2024-21887, a command injection vulnerability (CVSS 9.1) in Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure. The authentication bypass flaw allows an unauthenticated remote attacker to bypass security controls and access restricted resources, and the command injection flaw allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
The initial attacks were conducted by an unknown APT group that downloaded malware tool kits for espionage purposes. The latter attacks have been conducted by multiple threat actors. One actor has already attacked hundreds of appliances and backdoored targets’ systems using a GIFTEDVISITOR webshell variant. According to Volexity, as of January 14, 2023, more than 1,700 ICS VPN appliances had been compromised with the webshell.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
In addition to applying the mitigation measures, customers have been advised to run the Ivanti Integrity Checker Tool to identify signs of compromise.
