Ivanti Connect Secure 0-Days Exploited to Steal Active Directory Credentials

Key Takeaways

• A sophisticated attack chain leveraged three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances.
• The vulnerabilities allowed unauthenticated attackers to gain root-level access and steal sensitive Active Directory credentials.
• The attacks, tracked by Volexity as UTA0576, began in October 2026, targeting even fully patched systems.
• Ivanti has released a patch for two of the flaws (CVE-2026-104935), with a fix for the privilege escalation vulnerability pending.
• Detection is challenging, as the attackers operated largely in memory and avoided installing persistent backdoors.

Ivanti Connect Secure Zero-Days Actively Exploited for Credential Theft

A series of previously unknown vulnerabilities in Ivanti Connect Secure VPN appliances have been actively exploited in the wild, allowing attackers to achieve root access and exfiltrate critical Active Directory credentials. The campaign, which began on October 3, 2026, successfully targeted a fully updated Ivanti Connect Secure appliance running version 22.8R2.4, underscoring the severity of these zero-day flaws.

The intrusion was discovered by researchers at Volexity during an incident response investigation for a client. Volexity, which tracks the threat actor as UTA0576, collaborated with Ivanti to analyze the compromised device. Their findings reveal a sophisticated attack methodology focused on stealing sensitive directory information, including domain credentials, Local Administrator Password Solution (LAPS) passwords, and BitLocker recovery keys.

The Attack Chain: Unauthenticated Access to Root

The attackers exploited a chain of three distinct zero-day vulnerabilities. The initial entry involved a combination of an authentication bypass and a file-write vulnerability, collectively identified by Ivanti as CVE-2026-104935. This pairing allowed UTA0576 to execute code as the appliance’s cgi-server user without requiring authentication. Following this initial access, a separate privilege escalation flaw was exploited to gain full root privileges on the system.

Volexity’s analysis details how the initial bypass manipulated the appliance’s handling of web requests. By sending a request to a public login script, attackers could include an X-DSCGI-PATH header to redirect the appliance to a restricted script. This was then combined with an abuse of the file-upload handler, enabling the rapid execution of a temporary script before the appliance’s automatic deletion mechanism could remove it. This transient execution allowed the attackers to establish a foothold on the system.

Once code execution was achieved as cgi-server, the threat actor utilized the privileged dsinvoked service to elevate their access to root. This involved modifying configuration data within the appliance’s memory, instructing the service to execute an attacker-supplied script, and then meticulously restoring the original settings. Crucially, the exploit also erased specific entries from Ivanti debug and Linux audit logs. Because these modifications were performed in memory and subsequently reversed, Ivanti’s Integrity Checker Tool might not detect signs of compromise.

The UTA0576 actor did not deploy traditional web shells or backdoors. Instead, commands were issued and results received through the same HTTPS exploit channel, making detection through conventional file-based malware scans significantly more difficult. Organizations should be aware that a clean file system or the absence of persistent malware does not guarantee an uncompromised state.

Post-Exploitation Activity and Lateral Movement

Upon gaining root access, UTA0576 leveraged the VPN appliance’s Active Directory service account to query a domain controller via LDAP. Their reconnaissance focused on extracting critical data such as LAPS passwords, BitLocker recovery information, fields containing user passwords, logon script paths, and other user-specific details. The attackers also extracted credentials stored directly on the appliance, analyzed authentication logs for valid usernames, and attempted password spraying against Active Directory accounts.

The operation further included extensive network discovery and data collection. A packet-capture tool was deployed to sniff network traffic for LDAP credentials, HTTP Basic Authentication credentials, and NTLM challenge-response hashes. Volexity assesses with high confidence that this activity indicates preparation for lateral movement within the compromised network, although the ultimate objectives of UTA0576 remain unconfirmed.

This incident, along with previous campaigns like the SonicWall VPN credential theft, highlights the critical vulnerability of edge devices. While distinct in their actors and products, both scenarios demonstrate how these internet-facing systems can become gateways to sensitive internal network traffic and credentials.

Ivanti’s Response and Patch Availability

Ivanti released a fix for the authentication bypass and file-write vulnerabilities (CVE-2026-104935) on October 13, 2026. However, the privilege escalation flaw remains unpatched, with a solution expected in a future update.

What You Should Do

• Apply Updates Immediately: Install the latest Ivanti Connect Secure updates relevant to your appliance, especially the patch for CVE-2026-104935.
• Conduct Thorough Investigations: Scrutinize any Ivanti Connect Secure devices for signs of compromise, particularly if they were exposed before the patch was applied.
• Monitor for Suspicious Web Requests: Look for repeated requests to /dana-na/auth/url_default/welcome.cgi, especially those containing an X-DSCGI-PATH header directing to an unusual location (e.g., /home/webserver/htdocs/dana/fb/smb/wu.cgi or /home/runtime/tmp/<MD5(filename)>).
• Examine Temporary Directories: Check for unusual files and activity within the /tmp/ directory, such as ml.py, rq5.py, mk.py, rr.py, sp_out.txt, and spray_hits.json.
• Review Process Activity: Monitor for unexpected processes, particularly dsstatmond running from a hidden directory like /data/.icscap/.
• Perform Advanced Forensics: For suspected compromises, conduct memory and network forensics. Due to in-memory operations and log tampering, traditional file scans and log reviews may be insufficient to detect the intrusion.
• Scrutinize Network Traffic: Look for evidence of LDAP queries originating from the VPN appliance that appear unusual or excessively broad, as well as attempts to exfiltrate data.
• Defang Indicators: Exercise caution with the provided Indicators of Compromise (IoCs). Defang IP addresses and domains (e.g., [.] instead of .) before using them in uncontrolled environments. Re-fang only within secure threat intelligence platforms.

Indicators of Compromise (IoCs):-

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.