What happened
Volexity observed repeated exploitation beginning on October 3, 2026, and opened its investigation on October 5, 2026. The exploited appliance was running Ivanti Connect Secure 22.8R2.4, Build 19097, which was fully patched at the time of compromise. Investigators reconstructed an authentication bypass, file-write and remote-code-execution sequence followed by a separate privilege-escalation exploit that gave the operator root access.
The chain used /dana-na/auth/url_default/welcome.cgi with X-DSCGI-PATH values including /home/webserver/htdocs/dana/fb/smb/wu.cgi and /home/runtime/tmp/<MD5(filename)>. Recovered artefacts included /tmp/ml.py, /tmp/rq5.py, /tmp/mk.py, /tmp/rr.py, /data/.icscap/h.py and the renamed packet-capture binary /data/.icscap/dsstatmond. Volexity linked the infrastructure address 108.165.147[.]64 to the operation and said it hosted OpenVPN from September 30 to October 7, 2026. The cited pages did not publish file hashes for the recovered scripts and tools.
On October 13, 2026, Ivanti released fixes for CVE-2026-104935, while the separate privilege-escalation fix remained pending. The CVE record lists 22.8R2.5, 25.1.3.0, 25.1.3.1 and 22.7R2.14 as unaffected versions. The threat actor selectively removed entries from /home/runtime/dlogs/debuglog and /var/log/audit/audit.log, while the Integrity Checker Tool could miss the in-memory changes. Attribution posture: Volexity tracks the observed operator as UTA0576 but does not identify a real-world organisation, assessing criminal motivation only with low confidence.
Why this matters now
The affected product sits at a privileged network boundary and commonly holds authentication configuration, directory-service credentials and traffic visibility. Volexity observed the operator extracting Active Directory metadata, searching for LAPS passwords and BitLocker recovery material, conducting password spraying and capturing LDAP traffic. A successful edge compromise therefore creates an identity-containment problem even when no persistent web shell or conventional malware is found.
The Integrity Checker limitation changes the closure standard. The exploit modified memory, restored configuration data and selectively removed logs, allowing a patched or apparently clean appliance to remain an inadequate basis for concluding that the enterprise was not compromised. Organisations must distinguish vulnerable, patched and forensically cleared devices, and they must examine downstream credential and lateral-movement evidence rather than treating software version alone as closure.
The decision for security leaders
Direct incident response, identity and network teams to use separate workstreams for remediation and compromise assessment. The patch closes CVE-2026-104935, but it does not retrospectively establish that the appliance, its service accounts or reachable directory data remained trustworthy. Prioritise evidence acquisition before actions that destroy volatile memory or rotate logs.
Treat the appliance as a privileged identity and traffic system. If exploitation cannot be excluded, contain the associated LDAP or Active Directory service account, review access to LAPS passwords and BitLocker recovery information, and assess password-spraying or lateral-movement evidence. Record any decision not to rebuild or rotate credentials as a time-bound executive exception supported by forensic evidence.
Evidence of closure
- Asset records show every appliance on a fixed, vendor-supported release.
- Forensic findings document whether the published paths, files, infrastructure or log tampering were present.
- Credential-rotation records cover every directory account and secret reachable from suspected appliances.
- Validated network evidence shows no unexplained appliance-originated directory queries or lateral movement.
The Security.io assessment
The absence of a web shell is not reassuring in this case. Volexity observed the operator re-running the exploit chain for commands, returning output through HTTPS and cleaning evidence after use. That pattern reduces persistent artefacts while preserving practical command execution. An appliance can therefore appear operational and pass ordinary file-integrity checks while still requiring a compromise investigation.
The open privilege-escalation fix means organisations should follow Ivanti’s current product guidance and monitor for further releases rather than assuming the first patch fully neutralises every chain component. Where memory acquisition is unavailable, confidence in a negative finding should be explicitly reduced. Closure should depend on version evidence, forensic results, credential containment and validation that no downstream identity or lateral-movement activity occurred.
Questions for the morning meeting
- Which Ivanti Connect Secure appliances were externally reachable during the observed exploitation window?
- Can the team acquire memory and network evidence before rebooting or rebuilding suspected appliances?
- Which credentials, LAPS passwords or BitLocker keys were accessible through each appliance’s service account?