Ivanti Connect Secure Under Attack

Internet appliance maker Ivanti has begun releasing updates to patch a zero-day vulnerability being actively exploited by suspected nation-state attackers. Security experts urged users of all affected products to immediately update their devices, after factory resetting them to flush any malware attackers may have installed.

See Also: Securing Your Workforce with Datto RMM: Automating Patching, Hardening, and Backups

On Wednesday, Ivanti pushed an emergency update for its Ivanti Connect Secure – aka Pulse Secure – VPN appliances. The update patches two flaws, including a critical stack-based buffer overflow vulnerability tracked as CVE-2025-0282 that attackers have been exploiting remotely execute code on the devices. The vulnerabilities are present in a range of firmware versions, as detailed in Ivanti’s security advisory.

The other flaw, CVE-2025-0283, is also a stack-based buffer overflow, with a high severity rating. Ivanti said it’s seen no signs attackers are currently exploiting this flaw.

Ivanti on Wednesday released version 22.7R2.5 of Ivanti Connect Secure – aka ICS – to fix the flaws.

“Customers should apply available Ivanti Connect Secure patches immediately, without waiting for a typical patch cycle to occur,” said cybersecurity firm Rapid7 on Wednesday.

Before updating the devices, Ivanti recommends performing a factory reset, and installing a known-clean version of the same version of software the device was running prior to being reset. Security experts said some victims’ devices have been infected with malware designed to fake the update process, and give attackers continued, remote access to the backdoored appliances.

Ivanti credits discovery of the flaws to both Google’s Mandiant incident response division and Microsoft’s Threat Intelligence Center.

Attackers began exploiting the flaw in mid-December 2024, and have been using it to gain remote access and then move laterally through victims’ networks, said Charles Carmakal, CTO of Mandiant. In addition, “we’ve observed malware deployed to the device that enables network tunneling and credential harvesting,” he said in a LinkedIn post.

Both of the vulnerabilities are also present in Ivanti Policy Secure and Neurons for Zero Trust Access gateways, aka the nZTA platform. Ivanti said it’s seen no evidence of in-the-wild attacks targeting either. The company doesn’t yet have patches ready for those two products, but has promised to release them on Jan. 21.

In the interim, Ivanti Policy Secure “should not be exposed to the internet,” said Britain’s National Cyber Security Center, which is the public-facing arm of intelligence agency GCHQ. It further warned that for Ivanti Neurons for ZTA gateways, “if a gateway for this solution is generated and left unconnected to a ZTA controller, then there is a risk of exploitation.”

Ivanti recommends all users immediately review their networks for signs of intrusion. “This incident serves as a reminder of the importance of continuous monitoring and proactive and layered security measures, particularly for edge devices (such as VPNs) which provide an essential service as the initial access point to a corporate network – but which are also highly appealing to attackers,” it said.

The U.S. Cybersecurity and Infrastructure Security Agency recommends users of the affected products “conduct threat hunt actions on any systems connected to-or recently connected to-the affected Ivanti device.” CISA also detailed an extensive list of next steps organizations should follow if they suspect a device has been compromised.

To help, Ivanti offers an external Integrity Checker Tool, designed to verify the integrity of the firmware currently running on devices, which can sometimes identify if they’ve been exploited using CVE-2025-0282. The vendor said all of the CVE-2025-0282 exploits it’s identified to date have been via customers running its Integrity Checker Tool.

Caution: Malware Fakes Update Process

While that tool works for some scenarios, security experts cautioned that Ivanti-using organizations have no foolproof way to directly detect if their devices have been compromised and then modified. “The ICT offers a snapshot of the current state of the appliance and cannot necessarily detect threat actor activity if the appliance has been returned to a clean state,” Britain’s NCSC said. “The ICT does not scan for malware or indicators of compromise.”

Will Dormann, a senior principal vulnerability analyst at Maryland-based Analygence, said the tool relies on asking a potentially compromised device if it’s been compromised, likening it to trying to identify a bank robber by asking an individual if they robbed a bank. While a bad robber might say yes, all bets are off for more sophisticated attackers.

“The Ivanti ICT is the same concept. You ask your maybe-compromised device to pretty please run a scanner, and then tell you the results,” he said in a post to Mastodon. “This is the official company-sanctioned (and only official) way of checking the integrity of your ICS product.”

Mandiant said attackers have been successfully subverting the checker tool. “In some instances, the threat actor edited the ICT manifest to include their malicious files and circumvent detection,” Carmakal said.

Attackers have also been attempting to trick victims into believing they’ve installed an update, when in reality it’s been blocked, which is why Ivanti recommends the full factory reset and installing a known-good version of the firmware before attempting to update devices. “The threat actor deployed malware which blocks legitimate system upgrades while simultaneously displaying a fake upgrade progress bar,” Carmakal said. “This creates a convincing facade of a successful update, when in reality, the malware silently prevents the actual upgrade from taking place. Some organizations may assume they’ve addressed the vulnerability when they actually haven’t.”

Chinese Attackers Suspected

Mandiant said it’s attributed some of this attack activity to “a China-nexus threat actor” it tracks under the codename UNC5337 – UNC stands for an uncategorized group, meaning researchers haven’t yet deduced whether it trends more toward being a nation-state advanced persistent threat group, or more financially motivated – which appears to cross over with activity it’s previously tracked as UNC5221. That’s relevant because Mandiant tied the latter group to a suspected Chinese cyber espionage operation that began targeting a different Ivanti zero-day vulnerability on Dec. 3, 2023, which came to light in January 2024 (see: Ivanti Discloses Additional Zero-Day That Is Being Exploited).

The latest zero-day attacks resemble those from a year ago, carrying “all the hallmarks of APT usage of a zero-day against a mission-critical appliance,” said Benjamin Harris, CEO of attack surface management vendor watchTowr.

With reporting from Information Security Media Group’s Prajeet Nair in Bengaluru, India.