A VPN appliance exists so that the right people can get into the network from anywhere. In October, a chain of three flaws in one of the most widely used appliances let the wrong people do the same, without a password, and without leaving anything the vendor's own checking tool could find.
What happened
Volexity was called in on 5 October to look at a customer's Connect Secure appliance that was running the latest version. Working back, it found that the attacker had been in since 3 October, through a chain of flaws nobody had known about.
The first flaw let the attacker get past authentication and run commands on the appliance without logging in. The second let those commands run as root, with full control of the device. A third, described by CISA as a way to upload files with attacker-chosen content to a predictable location, can be chained with the other two. Ivanti fixed the first on 13 October and the others on 29 October, which means appliances patched in mid-October were still exposed to part of the chain for another two weeks.
The attacker installed no malware and no web shell. Instead it worked from memory, tampered with logs, and patched the running system so that Ivanti's Integrity Checker Tool, the utility customers are told to run to detect compromise, reported nothing wrong.
What it did next is the part that matters for any business. It took the directory credentials the appliance uses to check logins, ran a disguised network-capture tool to collect passwords and password hashes as staff connected, queried Active Directory and exported the results. It then ran a custom tool to search the directory for LAPS passwords, which are the local administrator passwords for every Windows computer, and for BitLocker recovery information, which unlocks encrypted disks. Volexity assessed with high confidence that the attacker was preparing to move into the wider network, and with medium confidence that it used large language models in its work.
Why this one matters
The VPN appliance is not just a door. It is connected to your directory, it sees every password your staff type when they connect from home, and it is trusted by the network behind it. Taking it over gives an attacker a vantage point that would otherwise require compromising a server inside the building.
The evasion is the other lesson. Customers who ran Ivanti's checking tool and got a clean result were not necessarily clean. CISA's advice for any appliance suspected of compromise is therefore blunt: factory reset it, upgrade, restore the configuration and reset every password and certificate it held.
This follows a pattern we have now written about several times in a month, from the Palo Alto firewalls to Cisco's VPN service. The devices at the edge of the network are where attackers start.
What to actually do
If you have Ivanti Connect Secure, update to the latest fixed release for your version line. The 29 October fixes are 25.1.1.3 and 22.8R2.6. Ivanti's version lines are confusing, so check its advisory for yours. Version 22.8 reaches end of life on 31 January 2027, so plan the move now.
If the appliance was exposed from early October, assume it may have been compromised. A clean Integrity Checker result is not enough here. Follow CISA's recovery steps: back up the configuration, factory reset, upgrade, restore, and then reset every password the appliance stored or saw, including the directory service account it uses. Revoke and reissue its certificates and API keys.
Change the passwords that passed through it. Because the attacker captured credentials as users connected, ask everyone who used the VPN since 3 October to change their password, and change the local administrator passwords on your Windows machines if you use LAPS.
Watch your Active Directory. Look for unusual queries and exports, for service accounts being used from the VPN appliance in unexpected ways, and for attempts to read LAPS or BitLocker recovery attributes.
Whatever VPN you use, keep the list short. Know which brand and version your remote-access appliance runs, who patches it, and how quickly. Edge devices get exploited within days of a flaw becoming known, and sometimes, as here, before.
The summary
UTA0576 needed no password, left no malware and fooled the vendor's own detection tool. What it was after was not the VPN itself but what the VPN could see: the credentials and directory of the business behind it.
If you run Ivanti Connect Secure, update it and treat October as a possible compromise. If you run something else, use this as the reason to find out exactly what your VPN is, who patches it and how fast.
Sources
- A series of unauthenticated events: chained exploitation of Ivanti Connect Secure zero-days — Volexity
- CISA urges patching newly exploited vulnerabilities in Ivanti Connect Secure — CISA
- CISA adds two known exploited vulnerabilities to catalog — CISA
- Attackers chain three Ivanti Connect Secure flaws — The Hacker News
- Ivanti Connect Secure zero-day exploited in the wild — Rapid7
- Ivanti warns of Connect Secure zero-day exploited in attacks — BleepingComputer
