Ivanti failed to issue an out-of-band patch for a high-severity defect in Ivanti Connect Secure after finding it in June. Attackers tracked as UTA0576 exploited the vulnerability in the wild starting October 1, chaining three zero-days to bypass authentication and execute code. Volexity researchers observed the threat actor stealing credentials and dumping Active Directory metadata from compromised appliances. CISA added the defect to its known exploited vulnerabilities catalog and advised customers to perform network forensics rather than rely solely on Ivanti's Integrity Checker Tool.
Read the full story at cyberscoop.com.
Photo: 23555986 / Pixabay
