CISA has issued an alert concerning ongoing exploitation of critical vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways, specifically CVE-2023-46805 and CVE-2024-21887. Threat actors are actively exploiting these vulnerabilities to capture credentials, deploy web shells, and conduct undetected lateral movement and privilege escalation within enterprise networks. Notably, adversaries have developed methods to circumvent existing mitigations and detection techniques, including subverting the external integrity checker tool (ICT) used in Ivanti devices.
Affected Products:
- Ivanti Connect Secure versions 9.x and 22.x
- Policy Secure Gateways (unspecified versions)
Threat Actor Tactics and Impact:
- Credential Harvesting: Attackers exploit the vulnerabilities to steal credentials, granting unauthorized access to enterprise systems.
- Web Shell Deployment: The exploitation enables the dropping of web shells, which facilitate persistent access and remote control over the compromised systems.
- Lateral Movement and Privilege Escalation: The vulnerabilities allow threat actors to navigate across network resources and elevate their privileges undetected.
- ICT Subversion: Sophisticated attackers have managed to bypass the external integrity checker tool, reducing the visibility of their activities.
Recommended Mitigations and Defensive Measures:
- Continuous Threat Hunting: Organizations using the affected Ivanti products should engage in proactive threat hunting on systems connected to the Ivanti devices.
- System Isolation: Systems should be isolated from enterprise resources to limit the potential spread of a breach.
- Monitoring: Close monitoring of authentication, account usage, and identity management services is advised to detect signs of compromise.
- Patch Vigilance: Following patch release, organizations should continue to search for indicators of past compromises to ensure no residual presence of threat actors.
- Adherence to CISA Guidance: Organizations should follow CISA’s updated guidance in conjunction with previous advisories for comprehensive protection.
The exploitation of these Ivanti vulnerabilities represents a serious threat to network security, demanding immediate and sustained action. Organizations are urged to implement the recommended mitigations, remain vigilant, and conduct thorough investigations to ensure network integrity. CISA’s ongoing advisories and future patches should be closely monitored and applied to maintain a robust security posture against these and emerging threats.
Stay safe and informed,
OP Innovate.
