Ivanti Connect Secure Zero-Day Exploited in the Wild: Detection and Emergency Response Guide

Ivanti has issued an urgent warning that a previously unpatched vulnerability in Ivanti Connect Secure (ICS), its SSL VPN and remote access gateway, is being actively exploited in attacks. Because ICS appliances sit directly on the network perimeter and broker access to internal resources, a compromise here is not a single-host event — it is a foothold on the edge of your enterprise with a direct path to credential theft, lateral movement, and full domain compromise.

Organizations running Ivanti Connect Secure (and in many past campaigns, the closely related Policy Secure and ZTA gateway components) should treat this as an emergency change window. The pattern we have seen repeatedly with Ivanti edge devices — and that defenders must assume applies again — is exploitation by sophisticated actors who move quickly to establish persistence, harvest credentials, and erase evidence of initial access.

Why This Matters Right Now

VPN and secure access gateways are among the highest-value targets in any enterprise attack surface:

They are internet-facing by design. Any unauthenticated vulnerability is reachable by anyone on the internet.
They hold privileged context. ICS appliances terminate VPN sessions, store cached credentials, and often integrate with Active Directory/LDAP and MFA infrastructure.
They are forensic black boxes. Appliances typically lack EDR coverage, limited logging, and restricted shell access — attackers know defenders are blind here.
Patching alone does not evict the attacker. If exploitation occurred before patching, webshells and persistence may survive the update. Assume breach until proven otherwise.

Technical Analysis

Affected Product

Product: Ivanti Connect Secure (ICS) — SSL VPN / remote access gateway
Exposure: Internet-facing HTTPS portal and administrative interfaces
Status at time of disclosure: Actively exploited in the wild; Ivanti has directed customers to patch immediately

Ivanti's advisory language — urging customers to "immediately patch" an issue already being exploited — indicates exploitation predated public disclosure, which is the definition of zero-day exploitation. Security teams should consult the official Ivanti Security Advisory page and the vendor's community portal for the exact fixed version numbers applicable to their branch, and monitor CISA's Known Exploited Vulnerabilities (KEV) catalog, as actively exploited ICS vulnerabilities are routinely added with aggressive federal remediation deadlines.

How These Attacks Typically Unfold (Defender's View)

While full technical details are limited at disclosure time, the Ivanti Connect Secure exploitation playbook observed across multiple campaigns follows a consistent chain:

Initial access: Exploitation of the internet-facing web service on the ICS appliance (the DSLogon / portal component), often without authentication.
Webshell deployment: Attackers drop or modify files in the appliance's web root (commonly under paths such as /home/websvr/ or /dana/ trees) to establish durable access that survives reboots.
Credential harvesting: Dumping cached VPN credentials, LDAP bind accounts, and session tokens from appliance memory or configuration stores.
Integrity check tampering: Bypassing or defeating Ivanti's built-in Integrity Checker Tool (ICT) so modified files are not flagged.
Lateral movement: Using harvested credentials and VPN access to pivot into the internal network — this is where the damage is done, and where most endpoint detection opportunities exist.

The practical implication: your detection strategy must operate on two planes — the appliance itself (log review, integrity checking) and the downstream internal network (credential abuse, anomalous VPN session behavior).

Exploitation Status

Active exploitation: Confirmed by the vendor
CISA KEV: Monitor for addition — prior actively exploited Ivanti flaws have been added rapidly
Public PoC: Not required for action; vendor-confirmed in-the-wild exploitation is sufficient

Detection & Response

The rules and queries below focus on the highest-fidelity, lowest-noise observable: the ICS web service spawning unexpected processes and webshell artifacts, plus downstream abuse of VPN-authenticated sessions. These are deliberately scoped — appliances spawning shells and touching web-root files is almost never legitimate outside a maintenance window.

YAML

---
title: Ivanti Connect Secure Web Process Spawning Shell or Command Interpreter
id: 3b9f2a71-6c44-4e58-b1d2-8a7c5e91f0ab
status: experimental
description: Detects the ICS web/portal process spawning shells or scripting interpreters, a hallmark of post-exploitation command execution on Ivanti appliances via webshells or command injection.
references:
  - https://www.bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
logsource:
  product: linux
  category: process_creation
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'dslogon'
      - 'websvr'
      - 'perl'
      - '/home/bin/'
  selection_child:
    CommandLine|contains:
      - '/bin/sh'
      - '/bin/bash'
      - 'curl '
      - 'wget '
      - 'base64'
      - 'chmod'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate appliance maintenance scripts executed during vendor-supervised support sessions
level: high
---
title: Webshell Artifact Written to Ivanti Connect Secure Web Root
id: 7d41c9e3-2a86-4f19-b6c3-5e8a1d40c2f7
status: experimental
description: Detects file creation or modification in ICS web-accessible directories, consistent with webshell deployment following exploitation of the Connect Secure portal.
references:
  - https://www.bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  product: linux
  category: file_event
detection:
  selection_path:
    TargetFilename|contains:
      - '/home/websvr/'
      - '/dana/'
      - '/var/web/'
  selection_ext:
    TargetFilename|endswith:
      - '.cgi'
      - '.pl'
      - '.py'
      - '.sh'
      - '.php'
  condition: all of selection_*
falsepositives:
  - Vendor-supplied hotfix or customization applied by administrators during a documented change window
level: high

The KQL below assumes ICS appliance syslog is forwarded to Microsoft Sentinel via a Linux syslog collector or CEF connector — if your ICS logs are not in Sentinel today, that is the first gap to close.

KQL — Microsoft Sentinel / Defender

// Hunt 1: Post-exploitation command execution artifacts in ICS syslog
Syslog
| where TimeGenerated > ago(14d)
| where Computer has_any ("ivanti", "ics", "connect-secure") or Facility contains "local"
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "websvr", "wget", "curl http", "chmod +x", "base64 -d")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;

// Hunt 2: Anomalous VPN session behavior - logins from unusual geographies/ASNs via ICS
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DeviceVendor contains "Ivanti" or DeviceProduct has_any ("Connect Secure", "ICS")
| where Message has_any ("login succeeded", "session started")
| summarize SessionCount = count(), DistinctIPs = dcount(SourceIP) by SourceUserID, SourceIP, SourceCountry, bin(TimeGenerated, 1h)
| where SourceCountry !in ("US", "CA")  // tune to your organization's expected geographies
| order by TimeGenerated desc;

// Hunt 3: Downstream lateral movement - new admin-like activity from VPN-assigned source IPs
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID in (4624, 4672)
| where LogonType in (3, 10)
| summarize by Account, IpAddress, Computer, bin(TimeGenerated, 1h)
| join kind=inner (
    CommonSecurityLog
    | where DeviceVendor contains "Ivanti"
    | summarize by VPNPoolIP = SourceIP
) on $left.IpAddress == $right.VPNPoolIP
| project TimeGenerated, Account, IpAddress, Computer;

VQL — Velociraptor

-- Hunt downstream Windows endpoints for suspicious child processes
-- launched by vpn/Ivanti client components or unusual process trees
-- shortly after VPN session establishment.
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(powershell.*(downloadstring|iex|frombase64)|cmd.*/c.*(whoami|net user|nltest)|wmic.*process call create)'
   OR Exe =~ '(?i)(\\temp\\|\\users\\public\\|\\programdata\\[^\\]+\.exe$)'
ORDER BY CreateTime DESC

Bash / Shell

#!/bin/bash
# Ivanti Connect Secure - Emergency Response Verification Script
# Run from a management host with SSH access to the ICS appliance (admin shell enabled).
# Adjust APPLIANCE and ADMIN_USER for your environment.

APPLIANCE="ics-gateway.example.com"
ADMIN_USER="admin"

echo "=== 1. Confirm appliance software version against Ivanti advisory ==="
ssh "${ADMIN_USER}@${APPLIANCE}" "cat /data/pkg/ive_version 2>/dev/null || show version"

echo "=== 2. Run built-in Integrity Checker Tool (ICT) - mandatory ==="
echo "-> Login to the admin UI > System > Maintenance > Integrity Check."
echo "-> If ICT reports ANY modified/new files: treat appliance as compromised."

echo "=== 3. Review web-accessible directories for unexpected files ==="
ssh "${ADMIN_USER}@${APPLIANCE}" "ls -lat /home/websvr/ 2>/dev/null | head -30; find /dana -newer /etc/hostname -type f 2>/dev/null | head -50"

echo "=== 4. Check for unexpected listeners and outbound connections ==="
ssh "${ADMIN_USER}@${APPLIANCE}" "netstat -anp 2>/dev/null | grep -E 'LISTEN|ESTABLISHED' | grep -v -E '443|22|80'"

echo "=== 5. Export auth and admin logs for off-box analysis ==="
ssh "${ADMIN_USER}@${APPLIANCE}" "cat /var/log/auth.log 2>/dev/null | tail -500" > ics_auth_log_export.txt
echo "-> Review ics_auth_log_export.txt for unexpected admin logins and config changes."

echo "=== 6. Verify factory-reset status if ICT failed ==="
echo "-> If ICT results are inconsistent or appliance was exploited pre-patch:"
echo "   Ivanti's guidance for confirmed compromise is FACTORY RESET + rebuild on patched code."

echo "=== DONE. Escalate findings to IR before returning appliance to service. ==="

Remediation

Execute in this order. Do not skip step 3 — patching a compromised appliance does not remove the attacker.

Apply the vendor patch immediately. Retrieve the fixed build for your ICS version branch directly from the Ivanti Security Advisories page and the Ivanti download portal. Ivanti has directed customers to patch now, not at the next maintenance window.
Restrict attack surface while patching. If patching must wait hours, temporarily restrict admin interface access to a management VLAN, and consider geo-IP or ACL restrictions on the portal as a partial (not sufficient) mitigation.
Run the Integrity Checker Tool (ICT). Ivanti's built-in ICT compares on-disk files against known-good hashes. Any flagged files — or an ICT that appears tampered with — means compromise. Note that advanced actors have historically defeated ICT, so a clean ICT result after pre-patch exposure is not conclusive.
If compromise is confirmed or strongly suspected: factory reset the appliance and rebuild on the patched version, per Ivanti's standard recovery guidance. Do not attempt surgical cleanup on a compromised gateway.
Rotate everything the appliance touched. This includes: all VPN user credentials, LDAP/AD bind accounts, service accounts configured on the appliance, local admin credentials, and any certificates/keys stored on it. Invalidate active VPN sessions and force re-authentication.
Hunt downstream before declaring victory. Query for credential abuse originating from VPN pool addresses, new account creation, and lateral movement in the days preceding the patch date (see KQL above). Assume a dwell time of days to weeks.
Verify log forwarding. Ensure ICS syslog (auth, admin, and event logs) is shipping to your SIEM off-box. On-box logs are attacker-controlled once the device is compromised.
Monitor CISA KEV. If added, federal agencies face a mandated remediation deadline — use it as leverage for emergency change approval in commercial environments too.

The Bigger Lesson

Edge device exploitation is now a routine initial access vector for both state-sponsored actors and ransomware affiliates. If your security architecture treats VPN appliances as trusted, unmanaged black boxes, this campaign is your forcing function: get appliance telemetry into the SIEM, pre-stage factory-reset runbooks, and build patch SLAs measured in hours — not weeks — for internet-facing remote access infrastructure.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub