Tag: ivanti
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 40
by
in SecurityNewsSecurity Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape CISA Releases Malware Analysis Report on RESURGE Malware Associated with Ivanti Connect Secure Unboxing Anubis: Exploring the Stealthy Tactics of FIN7’s Latest Backdoor Advancements in delivery: Scripting with Nietzsche Analyzing New HijackLoader Evasion Tactics Malicious Python…
-
Mandiant warns of attacks on newly-disclosed Ivanti remote takeover threat
First seen on scworld.com Jump to article: www.scworld.com/news/mandiant-warns-of-attacks-on-newly-disclosed-ivanti-remote-takeover-threat
-
Chinese Espionage Group Targeting Legacy Ivanti VPN Devices
by
in SecurityNewsMore Evidence Surfaces of Chinese Hackers Targeting Ivanti Products. A suspected Chinese cyberespionage operation is behind a spate of malware left on VPN appliances made by Ivanti. The threat actor used a critical security vulnerability the Utah company patched in February. We are aware of a limited number of customers whose appliances have been exploited.…
-
CISA Urges Patching For ‘Critical’ Ivanti VPN Flaw Exploited In Attacks
by
in SecurityNewsExploitation of a critical-severity Ivanti Connect Secure vulnerability prompted CISA to issue an advisory Friday, urging organizations to implement patches to fix the issue. First seen on crn.com Jump to article: www.crn.com/news/security/2025/cisa-urges-patching-for-critical-ivanti-vpn-flaw-exploited-in-attacks
-
CISA warns of latest Ivanti firewall bug being exploited by suspected Chinese hackers
by
in SecurityNewsResearchers attributed exploitation of the vulnerability to a suspected China-based cyberespionage group tracked as UNC5221. First seen on therecord.media Jump to article: therecord.media/cisa-ivanti-firewall-bug-exploitation
-
Ivanti Fully Patched Connect Secure RCE Vulnerability That Actively Exploited in the Wild
by
in SecurityNewsApril 5, 2025 Ivanti has issued an urgent security advisory for CVE-2025-22457, a critical vulnerability impacting Ivanti Connect Secure, Pulse Connect Secure, Ivanti Policy Secure, and ZTA Gateways. Rated at a CVSS score of 9.0, this stack-based buffer overflow has been actively exploited since mid-March 2025, posing a severe risk to organizations using these […]…
-
Chinese Hackers Exploit Ivanti VPN Vulnerability to Deliver Malware Payloads
by
in SecurityNewsIvanti disclosed a critical security vulnerability, CVE-2025-22457, affecting its Connect Secure (ICS) VPN appliances, particularly versions 22.7R2.5 and earlier. This buffer overflow vulnerability enables attackers to achieve remote code execution when exploited successfully. Security researchers from Mandiant and Ivanti have confirmed active exploitation of this vulnerability in the wild, targeting ICS 9.X (end-of-life) and earlier…
-
Ivanti warns customers of new critical flaw exploited in the wild
Remediation: Organizations are urged to immediately update their Ivanti Connect Secure appliances to version 22.7R2.6 released in February or later to address CVE-2025-22457. Customers should also use the external version of the Integrity Checker Tool and look for web server crashes.”If your ICT result shows signs of compromise, you should perform a factory reset on…
-
China-Linked Threat Group Exploits Ivanti Bug
The vendor had originally assessed the flaw as low risk but now says it is a critical issue that enables remote code execution. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/china-linked-threat-group-exploits-ivanti-bug
-
CVE-2025-22457: New Critical Ivanti Flaw Could Expose Entire Networks
by
in SecurityNewsOverview of the Vulnerability Ivanti has recently disclosed a significant security vulnerability, identified as CVE-2025-22457, affecting its Connect Secure, Policy Secure, and ZTA Gateway products. While specific details are pending, such vulnerabilities typically involve issues such as remote code execution,… First seen on sensorstechforum.com Jump to article: sensorstechforum.com/cve-2025-22457-critical-ivanti-flaw/
-
Chinese State Hackers Exploiting Newly Disclosed Ivanti Flaw
by
in SecurityNews
Tags: china, espionage, exploit, flaw, hacker, ivanti, mandiant, remote-code-execution, vulnerabilityMandiant warned that Chinese espionage actor UNC5221 is actively exploiting a critical Ivanti vulnerability, which can lead to remote code execution First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/chinese-state-hackers-ivanti-flaw/
-
CVE-2025-22457: Critical Ivanti Connect Secure Vulnerability
by
in SecurityNewsSummary On April 3, 2025, Ivanti disclosed CVE-2025-22457 that impacts Ivanti Connect Secure VPN appliances, PulseConnect Secure(end of service), Ivanti Policy Secure, and ZTA Gateways. First seen on research.kudelskisecurity.com Jump to article: research.kudelskisecurity.com/2025/04/04/cve-2025-22457-critical-ivanti-connect-secure-vulnerability/
-
Critical Ivanti Flaw Actively Exploited to Deploy TRAILBLAZE and BRUSHFIRE Malware
by
in SecurityNewsIvanti has disclosed details of a now-patched critical security vulnerability impacting its Connect Secure that has come under active exploitation in the wild.The vulnerability, tracked as CVE-2025-22457 (CVSS score: 9.0), concerns a case of a stack-based buffer overflow that could be exploited to execute arbitrary code on affected systems.”A stack-based buffer overflow in Ivanti Connect…
-
China-backed espionage group hits Ivanti customers again
by
in SecurityNewsUNC5221 has a knack for exploiting defects in Ivanti products. The group has exploited at least four vulnerabilities in the vendor’s products since 2023, according to Mandiant. First seen on cyberscoop.com Jump to article: cyberscoop.com/china-espionage-group-ivanti-vulnerability-exploits/
-
China-linked group UNC5221 exploited Ivanti Connect Secure zero-day since mid-March
by
in SecurityNews
Tags: china, exploit, flaw, group, ivanti, remote-code-execution, threat, update, vulnerability, zero-dayIvanti addressed a critical remote code execution flaw in Connect Secure, which has been exploited since at least mid-March 2025. Ivanti released security updates to address a critical Connect Secure remote code execution vulnerability tracked as CVE-2025-22457. The vulnerability has been exploited by a China-linked threat actor since at least mid-March 2025. Ivanti did not disclose…
-
Suspected Chinese spies right now hijacking buggy Ivanti gear for third time in 3 years
by
in SecurityNewsSimple denial-of-service blunder turned out to be a remote unauth code exec disaster First seen on theregister.com Jump to article: www.theregister.com/2025/04/03/suspected_chines_snoops_hijacked_buggy/
-
Ivanti VPN customers targeted via unrecognized RCE vulnerability (CVE-2025-22457)
by
in SecurityNewsA suspected Chinese APT group has exploited CVE-2025-22457 a buffer overflow bug that was previously thought not to be exploitable to compromise appliances … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/04/03/ivanti-vpn-customers-targeted-via-unrecognized-rce-vulnerability-cve-2025-22457/
-
Ivanti patches Connect Secure zero-day exploited since mid-March
by
in SecurityNews
Tags: china, espionage, exploit, ivanti, malware, remote-code-execution, update, vulnerability, zero-dayIvanti has released security updates to patch a critical Connect Secure remote code execution vulnerability exploited by a China-linked espionage actor to deploy malware since at least mid-March 2025. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ivanti-patches-connect-secure-zero-day-exploited-since-mid-march/
-
Chinese APT Pounces on Misdiagnosed RCE in Ivanti VPN Appliances
by
in SecurityNewsIvanti misdiagnoses a remote code execution vulnerability and Mandiant reports that Chinese hackers are launching in-the-wild exploits. The post Chinese APT Pounces on Misdiagnosed RCE in Ivanti VPN Appliances appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/chinese-apt-pounces-on-misdiagnosed-rce-in-ivanti-vpn-appliances/
-
Latest Ivanti bug, paired with malware, earns an alert from CISA
by
in SecurityNewsA recent alert from CISA builds on previous research about a vulnerability in Ivanti products that China-linked hackers have used to insert malware into networks. First seen on therecord.media Jump to article: therecord.media/cisa-alert-ivanti-bug-resurge-malware
-
Hackers Exploiting Vulnerabilities in SonicWall, Zoho, F5 Ivanti Systems
by
in SecurityNewsA surge in cyber activity targeting critical edge technologies and management tools, including SonicWall, Zoho, F5, Ivanti, and other systems, has been flagged by cybersecurity intelligence firm GreyNoise. The sudden spike in probing and exploitation attempts highlights an alarming trend: Hackers are increasingly targeting vulnerabilities in widely used systems, potentially exposing businesses to significant threats.…
-
Altgeräte bedrohen Sicherheit in Unternehmen
by
in SecurityNews
Tags: access, apache, authentication, botnet, bug, cisco, cloud, cve, cyberattack, dns, endpoint, firewall, Hardware, intelligence, Internet, ivanti, lazarus, linux, macOS, network, open-source, password, radius, ransomware, risk, router, sans, service, software, supply-chain, threat, update, vulnerabilitySchwachstellen in alten Netzwerkgeräten stellen ein erhebliches Sicherheitsrisiko für Unternehmen dar.Eine Analyse von Ciscos Threat-Intelligence-Team Talos zeigt, zwei der drei häufigsten Schwachstellen, auf die es Angreifer im Jahr 2024 abgesehen hatten, waren in alten Netzwerkgeräten zu finden. Das Problem ist, dass Hersteller dazu keine Patches mehr herausgeben.’Dies unterstreicht, wie wichtig es ist, veraltete Komponenten des…
-
Volume of attacks on network devices shows need to replace end of life devices quickly
by
in SecurityNews
Tags: access, apache, attack, authentication, best-practice, breach, cloud, control, credentials, cve, cyber, dns, endpoint, espionage, exploit, firewall, flaw, government, group, Hardware, infrastructure, injection, Internet, ivanti, lazarus, macOS, monitoring, network, north-korea, open-source, password, risk, router, russia, sans, service, software, threat, tool, update, vulnerabilityCVE-2023-1389, a vulnerability in TP-Link Archer AX21 router;CVE-2024-3400, a hole in Palo Alto Networks PAN-OS firewall operating system;CVE-2023-36845, a vulnerability in Juniper Networks Junos OS operating system;CVE-2021-44529, a vulnerability in Ivanti Endpoint Manager Cloud Service Appliance;CVE-2023-38035, a hole in Ivanti Sentry security gateway;CVE-2024-36401, a vulnerability in OSGeo GeoServer;CVE-2024-0012, a vulnerability in Palo Alto Neworks PAN-OS…
-
CISA spots spawn of Spawn malware targeting Ivanti flaw
Resurge an apt name for malware targeting hardware maker that has security bug after security bug First seen on theregister.com Jump to article: www.theregister.com/2025/04/01/cisa_ivanti_warning/
-
Fixed Ivanti Bug Used by Novel RESURGE Malware
by
in SecurityNewsFirst seen on scworld.com Jump to article: www.scworld.com/brief/cisa-fixed-ivanti-bug-used-by-novel-resurge-malware
-
Addressed Ivanti bug leveraged by novel RESURGE malware
by
in SecurityNewsFirst seen on scworld.com Jump to article: www.scworld.com/brief/cisa-addressed-ivanti-bug-leveraged-by-novel-resurge-malware
-
CISA Warns of Resurge Malware Connected to Ivanti Vuln
by
in SecurityNewsThreat actors are exploiting a vulnerability in Ivanti Connect Secure first disclosed by the vendor in January. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/cisa-warns-resurge-malware-ivanti-vuln
-
Rootkit, Backdoor and Tunneler: Ivanti Malware Does It All
by
in SecurityNewsCISA Publishes Anatomy of Advanced Ivanti VPN Malware. Hackers using Trojans connected to a malware family deployed by Chinese nation-state hackers are actively exploiting a now-patched vulnerability in Ivanti Connect Secure appliances. The malware contains capabilities of a rootkit, dropper, backdoor, bootkit, proxy and tunneler. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/rootkit-backdoor-tunneler-ivanti-malware-does-all-a-27881
-
CISA warns new malware targeting Ivanti zero-day vulnerability
by
in SecurityNewsCVE-2025-0282, a critical vulnerability that affects Ivanti’s Connect Secure, Policy Secure;and ZTA Gateway products, was disclosed and patched in January. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisa-warns-malware-targeting-ivanti-zero-day/743967/
-
New Malware Variant RESURGE Exploits Ivanti Vulnerability
by
in SecurityNewsCISA recommends immediate action to address malware variant RESURGE exploiting Ivanti vulnerability CVE-2025-0282 First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/malware-resurge-exploits-ivanti/