Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The article details malware and tactics used in attacks targeting Ivanti Connect Secure vulnerabilities from December 2024 to July 2025. It describes MDifyLoader, a loader based on libPeConv, which deploys Cobalt Strike Beacon through DLL side-loading. The attackers also utilized vshell, a multi-platform RAT, and Fscan, a network scanning tool. After gaining initial access, the threat actors performed lateral movement using brute-force attacks, exploited vulnerabilities, and used stolen credentials. They established persistence by creating domain accounts and registering malware as services or scheduled tasks. The attackers employed various evasion techniques, including the use of legitimate files and ETW bypasses.

This threat involves a sophisticated malware campaign exploiting vulnerabilities in Ivanti Connect Secure devices, specifically linked to CVE-2025-0282. The attackers use a loader named MDifyLoader, which is based on the libPeConv library, to deploy the Cobalt Strike Beacon payload through DLL side-loading techniques. This approach allows the malware to evade detection by masquerading as legitimate DLL files. Additionally, the attackers employ vshell, a multi-platform remote access Trojan (RAT), and Fscan, a network scanning tool, to facilitate reconnaissance and lateral movement within compromised networks. Initial access is achieved by exploiting the Ivanti Connect Secure vulnerabilities, followed by brute-force attacks and the use of stolen credentials to expand footholds. Persistence mechanisms include creating domain accounts and registering malware as Windows services or scheduled tasks, ensuring long-term access. The attackers also utilize multiple evasion techniques such as leveraging legitimate files and bypassing Event Tracing for Windows (ETW) to avoid detection by security monitoring tools. The tactics align with several MITRE ATT&CK techniques including T1053.005 (Scheduled Task), T1110.001 (Brute Force), T1133 (External Remote Services), T1543.003 (Windows Service), T1140 (Deobfuscate/Decode Files or Information), T1036 (Masquerading), T1021.002 (SMB/Windows Admin Shares), T1087 (Account Discovery), T1136.002 (Create Account), T1210 (Exploitation of Remote Services), T1098 (Account Manipulation), T1562.001 (Disable or Modify Tools), T1573 (Encrypted Channel), T1070.004 (File Deletion), and T1021.001 (Remote Services). Although no known exploits in the wild have been reported yet, the presence of active malware campaigns exploiting these vulnerabilities indicates a credible threat to organizations using Ivanti Connect Secure products.

Detailed information about Malware Identified in Attacks Exploiting Ivanti Connect Secure Vulnerabilities. Get real-time updates, technical details, and mitigat

Malware Identified in Attacks Exploiting Ivanti Connect Secure Vulnerabilities - Live Threat Intelligence - Threat Radar | OffSeq.com

Malware Identified in Attacks Exploiting Ivanti Connect Secure Vulnerabilities

Salt Typhoon, a Chinese state-sponsored threat actor, has been targeting major telecommunications providers worldwide by exploiting vulnerabilities in network devices. This analysis tracks global exposures of internet-facing devices associated with Salt Typhoon activity over six months, including Sophos Firewalls, Cisco IOS XE WebUIs, Ivanti Connect Secure, and Fortinet FortiClient EMS systems. Overall combined exposure decreased by 25%, with Sophos Firewall interfaces showing the largest reduction. Cisco IOS XE was the only platform with increased exposure. Geographically, most exposures remain concentrated in the United States, except for Sophos XG Firewall exposures in Germany. The persistence of exposed devices raises questions about remediation efforts and organizational responses to these threats.

Salt Typhoon is a Chinese state-sponsored threat actor that has been actively targeting major telecommunications providers globally by exploiting vulnerabilities in critical network infrastructure devices. The threat actor leverages multiple vulnerabilities, including CVE-2022-3236 and others linked to Sophos Firewalls, Cisco IOS XE WebUIs, Ivanti Connect Secure, and Fortinet FortiClient EMS systems. These devices are integral to network security and management, making their compromise highly impactful. Over a six-month tracking period, exposures of internet-facing devices vulnerable to Salt Typhoon activity have decreased by approximately 25%, with Sophos Firewall interfaces showing the most significant reduction. However, Cisco IOS XE WebUI exposures have increased, indicating a shifting attack surface. Geographically, while the majority of exposed devices remain in the United States, notable concentrations of Sophos XG Firewall exposures persist in Germany. The persistence of these exposures suggests incomplete remediation and potential gaps in organizational cybersecurity practices. The threat actor employs advanced tactics, techniques, and procedures (TTPs) such as remote code execution (T1203), credential access (T1078), lateral movement (T1021), and defense evasion (T1562), often deploying malware like ShadowPad and Masol RAT to maintain persistence and exfiltrate data. Despite no known exploits in the wild being reported at this time, the combination of exposed critical infrastructure devices and sophisticated adversary capabilities poses a substantial risk to targeted organizations. The lack of patch links and the presence of multiple CVEs indicate that vulnerabilities remain unpatched or partially mitigated in many environments, underscoring the need for urgent attention to these exposures.

Detailed information about The Persistent Threat of Salt Typhoon: Tracking Exposures of Potentially Targeted Devices. Get real-time updates, technical details, 

Title	Severity	Type	Source	Date

Threats Tagged 'ivanti connect secure'

Filter Threats

Threats Tagged 'ivanti connect secure'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility