Ivanti VPN attacks steal credentials despite fully patched appliances
Daily Cyber News: Ivanti VPN attacks steal credentials despite fully patched appliances
Attackers gained root access to an Ivanti Connect Secure appliance that was fully patched when the intrusion began. The chain combined three previously unknown weaknesses, required no authentication, and gave the actor a path to sensitive internal identity data. Investigators found searches for Active Directory credentials, recovery keys, and passwords, along with activity that appeared to prepare for movement into the wider network.
Key context: The attacker also used in-memory changes, restored settings, and deleted logs, which helped the activity evade routine file checks.
Additional detail: The practical response is to update affected systems immediately, then rotate credentials if there’s any sign of exposure.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.
Topics: cybersecurity news, cybersecurity, cyber risk, Ivanti VPN, Ivanti, attacks, steal, credentials, despite, fully.
