By 
Two zero-day vulnerabilities in Ivanti products which were revealed last week are being exploited globally, with over 1700 devices already compromised.
Volexity stated in a blog post that victims come from a variety of sectors including government, military, telecoms, technology, finance, consulting and aerospace.
The victims are globally distributed and vary greatly in size, from small businesses to some of the largest organizations in the world, including multiple Fortune 500 companies across multiple industry verticals.
On January 14 2024, Volexity had identified over 1700 ICS VPN appliances that were compromised with the GiftedVisitor webshell. These appliances have been indiscriminately targeted, with victims all over the world.
According to Volexity, the threat actor behind these compromises is the same Chinese group (UTA0178) who was first found exploiting the zero-day vulnerabilities back in December 2023.
However, other threat actors may also have access to the exploit and are actively targeting organizations. These include a group named “UTA0188.”
Volexity added that its scans may have uncovered only a fraction of those organizations compromised by attackers.
The security vendor suspects that there may be a higher number of compromised organizations than identified through scanning (which totalled more than 1,700). There was likely a period in which UTA0178 could have actioned these compromises before the mitigation was applied.
Ivanti first published an advisory about the two zero-days on January 10. At the time, less than 10 customers were impacted by exploitation of CVE-2023-46805 and CVE-2024-21887: two critical bugs in its Connect Secure and Policy Secure gateways.
CVE-2023-46805 is an authentication bypass vulnerability in the web component of the two products while CVE-2024-21887 is a command injection vulnerability in the same web components.
Patches won’t be released until the week of January 22, however, customers are recommended to apply the vendor’s mitigation immediately and run an Integrity Checker tool provided by Ivanti.
