Security News > 2024 > January > Ivanti Connect Secure zero-days exploited to deploy custom malware
Hackers have been exploiting the two zero-day vulnerabilities in Ivanti Connect Secure disclosed this week since early December to deploy multiple families of custom malware for espionage purposes.
Zipline Passive Backdoor: custom malware that can intercept network traffic, supports upload/download operations, creating reverse shells, proxy servers, server tunneling.
Thinspool Dropper: custom shell script dropper that writes the Lightwire web shell onto Ivanti CS, securing persistence.
Wirefire web shell: custom Python-based web shell supporting unauthenticated arbitrary command execution and payload dropping.
Even without attribution, the use of custom malware that provides continued access indicates that "UNC5221 intended to maintain its presence on a subset of high priority targets" even after a patch became available.
Ivanti warns of Connect Secure zero-days exploited in attacks.
News URL
Related news
- Ivanti warns of three more CSA zero-days exploited in attacks (source)
- Zero-Day Alert: Three Critical Ivanti CSA Vulnerabilities Actively Exploited (source)
- Ivanti fixes three CSA zero-days exploited in the wild (CVE-2024-9379, CVE-2024-9380, CVE-2024-9381) (source)
- North Korean ScarCruft Exploits Windows Zero-Day to Spread RokRAT Malware (source)
- Malicious ads exploited Internet Explorer zero day to drop malware (source)
- Botnet exploits GeoVision zero-day to install Mirai malware (source)