Malware Identified in Attacks Exploiting Ivanti Connect Secure Vulnerabilities
Malware campaigns exploiting vulnerabilities in Ivanti Connect Secure devices, specifically CVE-2025-0282, have been active from December 2024 through July 2025. Attackers use MDifyLoader to side-load Cobalt Strike Beacon DLLs, along with vshell RAT and Fscan network scanner, to maintain persistent access. Initial access is gained via brute-force attacks, direct exploitation, and stolen credentials. The threat actors employ advanced lateral movement, persistence mechanisms such as domain account creation and malware service/task registration, and evasion techniques including use of legitimate files and ETW bypasses. European organizations using Ivanti Connect Secure devices are particularly targeted. The threat is assessed as medium severity due to moderate impact and exploitation complexity. No public exploits are currently available.
AI Analysis
Technical Summary
This threat involves active malware campaigns targeting Ivanti Connect Secure devices by exploiting CVE-2025-0282. The attackers deploy MDifyLoader to side-load Cobalt Strike Beacon DLLs, alongside vshell RAT and Fscan network scanner, to establish and maintain persistent footholds. Initial access vectors include brute-force attacks, direct exploitation of the vulnerability, and use of stolen credentials. The adversaries use advanced lateral movement techniques, persistence through domain account creation and malware service/task registration, and evasion methods such as leveraging legitimate files and Event Tracing for Windows (ETW) bypasses. Although no public exploit code is available, the campaigns have been ongoing for several months and are particularly focused on European organizations using Ivanti Connect Secure devices.
Potential Impact
The impact includes unauthorized persistent access to affected Ivanti Connect Secure devices, enabling attackers to conduct lateral movement within networks, maintain persistence via domain accounts and malware services/tasks, and evade detection through sophisticated techniques. This can lead to compromise of sensitive information and network infrastructure. The threat is active and ongoing, but exploitation complexity and moderate impact result in a medium severity rating.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should prioritize detection of brute-force attempts, monitor for signs of MDifyLoader and Cobalt Strike Beacon activity, and implement controls to detect vshell RAT and Fscan network scanner usage. Since no public exploits are available, immediate patching guidance should be verified with Ivanti advisories. Focus on credential security and monitoring for persistence mechanisms such as unauthorized domain account creation and malware service/task registration is recommended.
Indicators of Compromise
- cve: CVE-2025-0282
- cve: CVE-2025-22457
- hash: 492cdc5bc3d8cc5e6440a0da246f6684
- hash: c793995b4be06c17bf4aae2e1302196b
- hash: d5bc25910f126796bef6658d840fb7c2
- hash: e880c4268fb48aebc5510e02f49d3bce
- hash: 2db036cd60fcf917daffc47dda63e46ec3b16e9c
- hash: e75b425ec60396a69fe2c936c6cbad3e4297e4a2
- hash: 09087fc4f8c261a810479bb574b0ecbf8173d4a8365a73113025bd506b95e3d7
- hash: 0cbf71efa09ec4ce62d95c1448553314728ed5850720c8ad40352bfbb39be99a
- hash: 1652ab693512cd4f26cc73e253b5b9b0e342ac70aa767524264fef08706d0e69
- hash: 45ecb7b23b328ab762d8519e69738a20eb0cd5618a10abb2c57a9c72582aa7e7
- hash: 48f3915fb8d8ad39dc5267894a950efc863bcc660f1654187b3d77a302fd040f
- hash: 54350d677174269b4dc25b0ccfb0029d6aeac5abbbc8d39eb880c9fd95691125
- hash: 699290a753f35ae3f05a7ea1984d95f6e6f21971a146714fca5708896e5e6218
- hash: 85f9819118af284e6b00ce49fb0c85ff0c0b9d7a0589e1bb56a275ed91314965
- hash: 9e91862b585fc4d213e9aaadd571435c1a007d326bd9b07b72dbecb77d1a27ac
- hash: a747be292339eae693b7c26cac0d33851cba31140fd0883371cc8de978583dbe
- hash: cff2afc651a9cba84a11a4e275cc9ec49e29af5fd968352d40aeee07fb00445e
- hash: f12250a43926dba46dcfb6145b7f1a524c0eead82bd1a8682307d1f2f1f1e66f
- url: http://proxy.objectlook.com:80
- url: http://query.datasophos.com:443
- domain: proxy.objectlook.com
- domain: query.datasophos.com
Malware Identified in Attacks Exploiting Ivanti Connect Secure Vulnerabilities
Description
Malware campaigns exploiting vulnerabilities in Ivanti Connect Secure devices, specifically CVE-2025-0282, have been active from December 2024 through July 2025. Attackers use MDifyLoader to side-load Cobalt Strike Beacon DLLs, along with vshell RAT and Fscan network scanner, to maintain persistent access. Initial access is gained via brute-force attacks, direct exploitation, and stolen credentials. The threat actors employ advanced lateral movement, persistence mechanisms such as domain account creation and malware service/task registration, and evasion techniques including use of legitimate files and ETW bypasses. European organizations using Ivanti Connect Secure devices are particularly targeted. The threat is assessed as medium severity due to moderate impact and exploitation complexity. No public exploits are currently available.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This threat involves active malware campaigns targeting Ivanti Connect Secure devices by exploiting CVE-2025-0282. The attackers deploy MDifyLoader to side-load Cobalt Strike Beacon DLLs, alongside vshell RAT and Fscan network scanner, to establish and maintain persistent footholds. Initial access vectors include brute-force attacks, direct exploitation of the vulnerability, and use of stolen credentials. The adversaries use advanced lateral movement techniques, persistence through domain account creation and malware service/task registration, and evasion methods such as leveraging legitimate files and Event Tracing for Windows (ETW) bypasses. Although no public exploit code is available, the campaigns have been ongoing for several months and are particularly focused on European organizations using Ivanti Connect Secure devices.
Potential Impact
The impact includes unauthorized persistent access to affected Ivanti Connect Secure devices, enabling attackers to conduct lateral movement within networks, maintain persistence via domain accounts and malware services/tasks, and evade detection through sophisticated techniques. This can lead to compromise of sensitive information and network infrastructure. The threat is active and ongoing, but exploitation complexity and moderate impact result in a medium severity rating.
Defensive Guidance
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should prioritize detection of brute-force attempts, monitor for signs of MDifyLoader and Cobalt Strike Beacon activity, and implement controls to detect vshell RAT and Fscan network scanner usage. Since no public exploits are available, immediate patching guidance should be verified with Ivanti advisories. Focus on credential security and monitoring for persistence mechanisms such as unauthorized domain account creation and malware service/task registration is recommended.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://blogs.jpcert.or.jp/en/2025/07/ivanti_cs.html"]
- Pulse Id
- 6879f8b560d48aaf15291507
Indicators of Compromise
Cve
| Value | Description | Copy |
|---|---|---|
cveCVE-2025-0282 | — | |
cveCVE-2025-22457 | — |
Hash
| Value | Description | Copy |
|---|---|---|
hash492cdc5bc3d8cc5e6440a0da246f6684 | — | |
hashc793995b4be06c17bf4aae2e1302196b | — | |
hashd5bc25910f126796bef6658d840fb7c2 | — | |
hashe880c4268fb48aebc5510e02f49d3bce | — | |
hash2db036cd60fcf917daffc47dda63e46ec3b16e9c | — | |
hashe75b425ec60396a69fe2c936c6cbad3e4297e4a2 | — | |
hash09087fc4f8c261a810479bb574b0ecbf8173d4a8365a73113025bd506b95e3d7 | — | |
hash0cbf71efa09ec4ce62d95c1448553314728ed5850720c8ad40352bfbb39be99a | — | |
hash1652ab693512cd4f26cc73e253b5b9b0e342ac70aa767524264fef08706d0e69 | — | |
hash45ecb7b23b328ab762d8519e69738a20eb0cd5618a10abb2c57a9c72582aa7e7 | — | |
hash48f3915fb8d8ad39dc5267894a950efc863bcc660f1654187b3d77a302fd040f | — | |
hash54350d677174269b4dc25b0ccfb0029d6aeac5abbbc8d39eb880c9fd95691125 | — | |
hash699290a753f35ae3f05a7ea1984d95f6e6f21971a146714fca5708896e5e6218 | — | |
hash85f9819118af284e6b00ce49fb0c85ff0c0b9d7a0589e1bb56a275ed91314965 | — | |
hash9e91862b585fc4d213e9aaadd571435c1a007d326bd9b07b72dbecb77d1a27ac | — | |
hasha747be292339eae693b7c26cac0d33851cba31140fd0883371cc8de978583dbe | — | |
hashcff2afc651a9cba84a11a4e275cc9ec49e29af5fd968352d40aeee07fb00445e | — | |
hashf12250a43926dba46dcfb6145b7f1a524c0eead82bd1a8682307d1f2f1f1e66f | — |
Url
| Value | Description | Copy |
|---|---|---|
urlhttp://proxy.objectlook.com:80 | — | |
urlhttp://query.datasophos.com:443 | — |
Domain
| Value | Description | Copy |
|---|---|---|
domainproxy.objectlook.com | — | |
domainquery.datasophos.com | — |
Threat ID: 687a0dd5a83201eaacf17323
Added to database: 07/18/2025, 09:03:17 UTC
Last enriched: 08/04/2026, 12:56:56 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 674
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.