Ivanti Connect Secure Zero-Days Chained in Active Attacks: Detection and Remediation Guide

On October 15, 2025, Ivanti released security updates addressing two additional vulnerabilities in Connect Secure (ICS) remote access gateways that threat actors have been chaining in attacks since at least October 1. These flaws represent yet another wave of targeted exploitation against internet-facing VPN and remote access infrastructure — a pattern that has defined the Ivanti threat landscape throughout 2024 and into 2025.

If you operate Ivanti Connect Secure gateways in your environment, assume you are a target. These devices sit at the perimeter, handle authentication for remote access, and are high-value objectives for initial access brokers, ransomware affiliates, and nation-state actors. The fact that these vulnerabilities were exploited in the wild before patches were available means organizations need to not only patch immediately but also conduct thorough compromise assessments.

What Happened

Ivanti disclosed that two previously unknown vulnerabilities in Connect Secure were being actively exploited in chained attacks beginning no later than October 1, 2025. The vulnerabilities affect unpatched ICS appliances and have been observed in targeted campaigns. While Ivanti has not yet publicly assigned CVE identifiers at the time of initial disclosure, the company confirmed that exploitation was detected through a combination of customer reports, internal telemetry, and collaboration with incident response teams.

The attack chain reportedly involves gaining initial access through the first vulnerability, then leveraging the second to escalate privileges or maintain persistence on the device. Connect Secure appliances run a hardened Linux-based operating system and provide SSL VPN, network access control, and application delivery services. Compromise of these devices gives attackers a beachhead inside the network, the ability to intercept credentials, and a platform for lateral movement.

This is not the first time Ivanti products have been targeted. Throughout 2024 and 2025, Connect Secure and its sister product Policy Secure have been the subject of multiple zero-day disclosures, mass exploitation events, and CISA emergency directives. The recurring pattern underscores the reality that internet-facing remote access infrastructure is under constant attack, and patch velocity is a matter of organizational survival.

Technical Analysis

Affected Products and Versions

At the time of disclosure, Ivanti has not released a complete list of affected versions, but the vulnerabilities impact supported versions of Ivanti Connect Secure. Organizations running ICS 9.x and 22.x should assume they are vulnerable until they apply the vendor-supplied patches. Ivanti has historically released patches for the two most recent major versions, leaving older branches without fixes.

Ivanti Connect Secure is deployed as a physical appliance, virtual appliance (VMware, Hyper-V, KVM), or cloud instance (AWS, Azure). All deployment models are affected. The vulnerabilities reside in the web-facing components of the ICS platform, specifically in the administrative interface and user portal services.

Vulnerability Details

Ivanti has not yet published detailed technical writeups or assigned CVEs at the time of this writing, but based on the attack chain description and historical Ivanti vulnerability patterns, the likely scenarios include:

Authentication Bypass: The first vulnerability may allow unauthenticated attackers to bypass login mechanisms or access restricted functionality on the administrative or user portals.
Command Injection or Code Execution: The second vulnerability likely enables authenticated attackers (or attackers who have bypassed authentication via the first flaw) to execute arbitrary commands on the underlying operating system with elevated privileges.

Ivanti Connect Secure appliances run a custom Linux distribution with a web application stack that handles authentication, session management, and VPN tunneling. Previous vulnerabilities in ICS have exploited improper input validation, path traversal, insecure deserialization, and command injection in CGI scripts and backend APIs.

Exploitation Status

Confirmed active exploitation in the wild since at least October 1, 2025. This is not theoretical. Ivanti has observed real-world attacks chaining these vulnerabilities. CISA is expected to add these vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog and issue an Emergency Directive for federal civilian agencies. Private sector organizations should treat this with the same urgency.

Threat actors targeting Connect Secure have historically included:

Initial Access Brokers (IABs) who sell VPN access to ransomware affiliates
Nation-state actors conducting espionage and pre-positioning for future operations
Ransomware operators using compromised VPNs as entry points for network-wide encryption

The window between disclosure and mass exploitation is typically measured in hours, not days. Scanning for vulnerable ICS instances begins almost immediately after public disclosure.

Detection and Response

Organizations that were running unpatched Connect Secure appliances between October 1 and the patch release date must assume compromise and conduct thorough forensic investigations. Patching alone is not sufficient — you need to determine whether attackers established persistence, harvested credentials, or moved laterally before you applied the fix.

Sigma Rules

The following Sigma rules target observable behaviors associated with post-exploitation activity on compromised Connect Secure appliances. These rules assume you are collecting syslog, authentication logs, and network telemetry from ICS devices into your SIEM.

YAML

---
title: Ivanti Connect Secure Suspicious CGI Execution
id: 8f3a2b91-4c7d-4e9a-b1f6-2d8e7a9c5b4d
status: experimental
description: Detects suspicious execution of CGI scripts on Ivanti Connect Secure appliances, which may indicate exploitation of web-based vulnerabilities.
references:
  - https://www.bleepingcomputer.com/news/security/ivanti-patches-two-more-connect-secure-zero-days-chained-in-attacks/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2025/10/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  product: linux
  service: syslog
detection:
  selection:
    - Image|contains:
        - '/dana/'
        - '/admin/'
    - CommandLine|contains:
        - 'wget'
        - 'curl'
        - 'chmod +x'
        - 'bash -i'
        - '/dev/tcp/'
        - 'nc -e'
        - 'python -c'
  condition: selection
falsepositives:
  - Legitimate administrative scripts during maintenance windows
level: high
---
title: Ivanti Connect Secure Unexpected Process Spawn
id: 3e9f7a12-8b4c-4d6e-9f1a-5c2b8d4e6a7f
status: experimental
description: Detects unexpected process execution on Ivanti Connect Secure appliances that may indicate post-exploitation activity.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2025/10/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains:
      - '/dana/'
      - 'httpd'
      - 'nginx'
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/python'
      - '/perl'
      - '/wget'
      - '/curl'
  condition: selection
falsepositives:
  - Legitimate backup or monitoring scripts
  - Vendor support tools during troubleshooting
level: high
---
title: Ivanti Connect Secure Anomalous Outbound Connection
id: 7c1f4e83-9a5b-4d2f-8e6c-3b9a1f7d4e2c
status: experimental
description: Detects anomalous outbound network connections from Ivanti Connect Secure appliances, which may indicate command-and-control activity or data exfiltration.
references:
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2025/10/15
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    SourceHostname|contains: 'ivanti'
    DestinationIp|cidr:
      - '0.0.0.0/0'
    DestinationPort:
      - 4444
      - 5555
      - 6666
      - 7777
      - 8888
      - 9999
  filter_rfc1918:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_rfc1918
falsepositives:
  - Legitimate connections to Ivanti update servers or licensing infrastructure
level: medium

KQL Hunt Query (Microsoft Sentinel / Defender)

If you ingest Ivanti Connect Secure syslog into Microsoft Sentinel via a Linux log forwarder or a network security appliance, use the following KQL query to hunt for suspicious authentication failures, unexpected process execution, and anomalous network connections.

KQL — Microsoft Sentinel / Defender

// Hunt for suspicious activity on Ivanti Connect Secure appliances
// Assumes syslog ingestion via CommonSecurityLog or Syslog table

let LookbackPeriod = 14d;

// Suspicious process execution
Syslog
| where TimeGenerated > ago(LookbackPeriod)
| where Computer contains "ivanti" or Computer contains "ics"
| where ProcessName in~ ("bash", "sh", "python", "perl", "wget", "curl", "nc")
| where SyslogMessage has_any ("/dana/", "wget", "curl", "chmod", "bash -i", "/dev/tcp/", "nc -e")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, SeverityLevel
| order by TimeGenerated desc;

// Anomalous outbound connections from ICS appliances
CommonSecurityLog
| where TimeGenerated > ago(LookbackPeriod)
| where DeviceVendor == "Ivanti" or SourceHostName contains "ivanti"
| where DestinationPort in (4444, 5555, 6666, 7777, 8888, 9999)
| where not(ipv4_is_private(DestinationIP))
| project TimeGenerated, SourceHostName, SourceIP, DestinationIP, DestinationPort, Protocol
| order by TimeGenerated desc;

// Failed authentication attempts followed by success (potential brute force or credential stuffing)
Syslog
| where TimeGenerated > ago(LookbackPeriod)
| where Computer contains "ivanti" or Computer contains "ics"
| where SyslogMessage has_any ("authentication failure", "login failed", "invalid credentials")
| summarize FailedAttempts = count() by SourceIP = extract(@"from ([0-9.]+)", 1, SyslogMessage), Computer, bin(TimeGenerated, 5m)
| where FailedAttempts > 5
| join kind=leftouter (
    Syslog
    | where TimeGenerated > ago(LookbackPeriod)
    | where Computer contains "ivanti" or Computer contains "ics"
    | where SyslogMessage has_any ("authentication successful", "login successful")
    | extend SourceIP = extract(@"from ([0-9.]+)", 1, SyslogMessage)
    | summarize SuccessfulLogins = count() by SourceIP, Computer, bin(TimeGenerated, 5m)
) on SourceIP, Computer, TimeGenerated
| where isnotempty(SuccessfulLogins)
| project TimeGenerated, Computer, SourceIP, FailedAttempts, SuccessfulLogins
| order by TimeGenerated desc;

Velociraptor VQL Hunt

If you have deployed Velociraptor or a similar DFIR tool to your Ivanti Connect Secure appliances (typically via SSH access or a forensic agent), use the following VQL artifact to hunt for suspicious processes, recently modified files, and unexpected network connections.

VQL — Velociraptor

-- Hunt for suspicious processes and network connections on Ivanti Connect Secure
-- Deploy this artifact to ICS appliances via SSH or local collection

LET suspicious_processes = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(bash|sh|python|perl|wget|curl|nc)'
   OR CommandLine =~ '(wget|curl|chmod|bash -i|/dev/tcp/|nc -e)'
   OR Exe =~ '/tmp/'
   OR Exe =~ '/dev/shm/'

LET suspicious_network = SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, State
FROM netstat()
WHERE State =~ 'ESTABLISHED'
  AND RemotePort IN (4444, 5555, 6666, 7777, 8888, 9999)
  AND NOT RemoteAddr =~ '^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)'

LET recently_modified = SELECT FullPath, Size, Mtime, Ctime, Atime
FROM glob(globs='/dana/**/*.cgi')
WHERE Mtime > (now() - 1209600)  -- Modified in last 14 days
ORDER BY Mtime DESC

SELECT * FROM suspicious_processes
UNION ALL
SELECT * FROM suspicious_network
UNION ALL
SELECT * FROM recently_modified

Remediation Script

The following Bash script can be executed on Ivanti Connect Secure appliances via SSH to check for common indicators of compromise, collect forensic artifacts, and verify patch status. This script assumes you have administrative SSH access to the ICS appliance.

Bash / Shell

#!/bin/bash
# Ivanti Connect Secure IOC Hunt and Patch Verification Script
# Run with root privileges via SSH

LOG_FILE="/tmp/ivanti_ioc_hunt_$(date +%Y%m%d_%H%M%S).log"

echo "=== Ivanti Connect Secure IOC Hunt - $(date) ===" | tee -a "$LOG_FILE"

# Check current ICS version
echo -e "\n[*] Current ICS Version:" | tee -a "$LOG_FILE"
cat /etc/ivanti/version 2>/dev/null || echo "Version file not found" | tee -a "$LOG_FILE"

# Check for suspicious processes
echo -e "\n[*] Suspicious Processes:" | tee -a "$LOG_FILE"
ps aux | grep -E "(bash -i|nc -e|/dev/tcp/|wget|curl.*http)" | grep -v grep | tee -a "$LOG_FILE"

# Check for recently modified CGI files
echo -e "\n[*] Recently Modified CGI Files (last 14 days):" | tee -a "$LOG_FILE"
find /dana -name "*.cgi" -mtime -14 -ls 2>/dev/null | tee -a "$LOG_FILE"

# Check for suspicious files in /tmp and /dev/shm
echo -e "\n[*] Suspicious Files in /tmp and /dev/shm:" | tee -a "$LOG_FILE"
find /tmp /dev/shm -type f -executable -ls 2>/dev/null | tee -a "$LOG_FILE"

# Check for unexpected network connections
echo -e "\n[*] Established Network Connections (non-standard ports):" | tee -a "$LOG_FILE"
netstat -tunap 2>/dev/null | grep ESTABLISHED | grep -E ":(4444|5555|6666|7777|8888|9999)" | tee -a "$LOG_FILE"

# Check authentication logs for brute force or anomalous logins
echo -e "\n[*] Recent Failed Authentication Attempts:" | tee -a "$LOG_FILE"
grep -i "authentication failure\|login failed" /var/log/messages* 2>/dev/null | tail -20 | tee -a "$LOG_FILE"

echo -e "\n[*] Recent Successful Logins from External IPs:" | tee -a "$LOG_FILE"
grep -i "authentication successful\|login successful" /var/log/messages* 2>/dev/null | grep -v "192.168.\|10.\|172.16." | tail -20 | tee -a "$LOG_FILE"

# Check for unauthorized SSH keys
echo -e "\n[*] SSH Authorized Keys:" | tee -a "$LOG_FILE"
find /home /root -name "authorized_keys" -exec ls -la {} \; 2>/dev/null | tee -a "$LOG_FILE"

# Check for scheduled tasks or cron jobs
echo -e "\n[*] Cron Jobs:" | tee -a "$LOG_FILE"
crontab -l 2>/dev/null | tee -a "$LOG_FILE"
ls -la /etc/cron.d/ /etc/cron.daily/ /etc/cron.hourly/ 2>/dev/null | tee -a "$LOG_FILE"

echo -e "\n[*] Hunt complete. Results saved to $LOG_FILE"
echo -e "\n[!] IMPORTANT: If suspicious activity was detected, isolate this appliance immediately and contact your incident response team."
echo -e "[!] Next step: Apply the latest Ivanti security updates from https://portal.ivanti.com/"

Remediation

Immediate Actions

Apply Ivanti security updates immediately. Download and install the patches from the Ivanti customer portal at https://portal.ivanti.com/. Verify that you are running a patched version of Connect Secure. If you are running an end-of-support version that will not receive a patch, you must upgrade to a supported version or decommission the device.
Assume breach and conduct a compromise assessment. If your ICS appliances were internet-facing and unpatched between October 1 and the patch date, assume they were compromised. Review authentication logs, VPN session logs, and network traffic for signs of unauthorized access, unusual geographic locations, or connections from known malicious IP addresses.
Reset all credentials. Force password resets for all user accounts that authenticated through the ICS gateway. Revoke and reissue any certificates stored on the device. Rotate API keys, service account passwords, and any credentials that may have been accessible from the appliance.
Review administrative access. Audit all administrative accounts on the ICS appliance. Look for unauthorized accounts, unexpected privilege escalations, or changes to access control policies. Enable multi-factor authentication (MFA) for all administrative access if not already in place.
Hunt for persistence mechanisms. Check for unauthorized SSH keys, cron jobs, startup scripts, or modified system files. Threat actors who compromise VPN appliances often install backdoors to maintain access even after patches are applied.

Vendor Advisory and CISA Guidance

Ivanti Security Advisory: Monitor the Ivanti Security Advisories page at https://www.ivanti.com/blog/security-advisories for updated guidance, CVE assignments, and additional technical details.
CISA Known Exploited Vulnerabilities (KEV): Expect these vulnerabilities to be added to the CISA KEV catalog within 24-48 hours of public disclosure. Federal civilian agencies will be required to patch within a mandated timeframe (typically 72 hours to 7 days). Private sector organizations should adopt the same urgency.
CISA Emergency Directive: CISA may issue an Emergency Directive requiring immediate patching, threat hunting, and reporting for federal agencies. Review the directive requirements and apply them to your environment as a best practice.

Long-Term Hardening

Network segmentation: Place ICS appliances in a DMZ with strict firewall rules. Do not allow direct outbound internet access from the ICS device except to required Ivanti update and licensing servers.
Restrict administrative access: Limit administrative interface access to a dedicated management network. Do not expose the admin portal to the internet.
Enable logging and monitoring: Forward all ICS syslog to a centralized SIEM. Monitor for authentication anomalies, unexpected process execution, and anomalous network connections.
Implement zero trust: Consider migrating from legacy VPN architectures to zero trust network access (ZTNA) solutions that do not rely on perimeter appliances and provide more granular access controls.
Threat intelligence integration: Subscribe to threat feeds that include indicators of compromise (IOCs) for Ivanti exploitation campaigns. Block known malicious IPs at the perimeter.

If You Cannot Patch Immediately

If you cannot apply the patch immediately due to change control requirements or operational constraints, implement the following compensating controls:

Take the appliance offline if it is not mission-critical. If you have redundant ICS gateways, remove unpatched devices from the load balancer pool.
Restrict access via firewall rules. Limit inbound connections to the ICS appliance to known IP ranges (e.g., your corporate IP space, specific partner networks). This is not a complete mitigation but reduces your attack surface.
Increase monitoring and alerting. Deploy the Sigma rules and KQL queries provided in this post. Set up high-priority alerts for any suspicious activity on ICS appliances.
Prepare for emergency patching. Schedule an emergency change window and have rollback procedures ready. The risk of running unpatched outweighs the risk of patch-related outages.

Conclusion

Ivanti Connect Secure continues to be a high-value target for threat actors. The pattern of zero-day exploitation, chained vulnerabilities, and rapid weaponization is unlikely to change. Organizations that rely on ICS for remote access must adopt an assume-breach mindset, prioritize patch velocity, and invest in detection and response capabilities.

Patching is necessary but not sufficient. You must also hunt for signs of prior compromise, reset credentials, and review access controls. The window between disclosure and mass exploitation is measured in hours. If you have not already applied the patch, stop reading and do it now.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub