Volexity Ivanti Zero-Day Exploitation January 2024

During Cutting Edge, threat actors used Task Manager to dump LSASS memory from Windows devices to disk.

During Cutting Edge, threat actors accessed and mounted virtual hard disk backups to extract
ntds.dit.

During Cutting Edge, threat actors stole the running configuration and cache data from targeted Ivanti Connect Secure VPNs.

During Cutting Edge, threat actors used RDP with compromised credentials for lateral movement.

During Cutting Edge, threat actors moved laterally using compromised credentials to connect to internal Windows systems with SMB.

During Cutting Edge, threat actors used SSH for lateral movement.

During Cutting Edge, threat actors modified a JavaScript file on the Web SSL VPN component of Ivanti Connect Secure devices to keylog credentials.

During Cutting Edge, threat actors modified the JavaScript loaded by the Ivanti Connect Secure login page to capture credentials entered.

GLASSTOKEN can use PowerShell for command execution.

During Cutting Edge, threat actors used a Python reverse shell and the PySoxy SOCKS5 proxy tool.

During Cutting Edge, threat actors cleared logs to remove traces of their activity and restored compromised systems to a clean state to bypass manufacturer mitigations for CVE-2023-46805 and CVE-2024-21887.

WIREFIRE can respond to specific HTTP `POST` requests to `/api/v1/cav/client/visits`.

During Cutting Edge, threat actors used compromised VPN accounts for lateral movement on targeted networks.

During Cutting Edge, threat actors leveraged exploits to download remote files to Ivanti Connect Secure VPNs.

GLASSTOKEN has hexadecimal and Base64 encoded C2 content.

GLASSTOKEN has the ability to decode hexadecimal and Base64 C2 requests.

During Cutting Edge, threat actors exploited CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure VPN appliances to enable authentication bypass and command injection. A server-side request forgery (SSRF) vulnerability, CVE-2024-21893, was identified later and used to bypass mitigations for the initial two vulnerabilities by chaining with CVE-2024-21887.

GLASSTOKEN is a web shell capable of tunneling C2 connections and code execution on compromised Ivanti Secure Connect VPNs.

During Cutting Edge, threat actors used multiple web shells to maintain presence on compromised Connect Secure appliances such as WIREFIRE, GLASSTOKEN, BUSHWALK, LIGHTWIRE, and FRAMESTING.

During Cutting Edge, threat actors trojanized legitimate files in Ivanti Connect Secure appliances with malicious code.

WIREFIRE can modify the `visits.py` component of Ivanti Connect Secure VPNs for file download and arbitrary command execution.

During Cutting Edge, threat actors peformed reconnaissance of victims' internal websites via proxied connections.

During Cutting Edge, threat actors disabled logging and modified the `compcheckresult.cgi` component to edit the Ivanti Connect Secure built-in Integrity Checker exclusion list to evade detection.