Security News > 2024 > January > Ivanti Connect Secure zero-days exploited to deploy custom malware
Hackers have been exploiting the two zero-day vulnerabilities in Ivanti Connect Secure disclosed this week since early December to deploy multiple families of custom malware for espionage purposes.
Zipline Passive Backdoor: custom malware that can intercept network traffic, supports upload/download operations, creating reverse shells, proxy servers, server tunneling.
Thinspool Dropper: custom shell script dropper that writes the Lightwire web shell onto Ivanti CS, securing persistence.
Wirefire web shell: custom Python-based web shell supporting unauthenticated arbitrary command execution and payload dropping.
Even without attribution, the use of custom malware that provides continued access indicates that "UNC5221 intended to maintain its presence on a subset of high priority targets" even after a patch became available.
Ivanti warns of Connect Secure zero-days exploited in attacks.