{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/connect-secure/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-104935"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Connect Secure (22.8R2.4 and older)","Connect Secure (25.1.1.1 and older)","Connect Secure (25.1.2.2 and older)","Connect Secure"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","rce","network-appliance"],"_cs_type":"threat","_cs_vendors":["Ivanti"],"content_html":"\u003cp\u003eIvanti has disclosed a critical zero-day vulnerability, CVE-2026-104935, affecting Ivanti Connect Secure, a solution used to provide remote access to organizational systems and applications. The vulnerability allows an unauthenticated, remote attacker to execute arbitrary commands on the appliance without the need for valid credentials. Ivanti has assigned a CVSS score of 8.6 to this vulnerability. The Netherlands National Cyber Security Centre (NCSC) and Ivanti have confirmed that this vulnerability is being actively exploited by malicious actors in the wild to gain unauthorized access to target organizations. Due to the nature of the appliance providing network-level access, successful exploitation significantly compromises the security of downstream internal systems. Organizations are advised to verify their current version and apply security patches immediately. Because the vulnerability allows for persistent unauthorized control, patching alone is insufficient if the system has already been compromised; incident response procedures must be followed if intrusion is suspected.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for full system control by unauthorized actors, potentially leading to widespread data exfiltration, lateral movement within the network, and the deployment of additional malicious tools. The vulnerability is being exploited in the wild against a limited number of customers. The NCSC classifies both the risk of exploitation and the potential damage as high.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify the current version of Ivanti Connect Secure and verify it against the patches listed by Ivanti.\u003c/li\u003e\n\u003cli\u003eApply the relevant security update immediately. For the 22.8 series, update to 22.8R2.5 or migrate to the 25.1 branch (25.1.1.2 or newer). For the 25.1 series, update to 25.1.1.2, 25.1.2.2 (if supported by migration path), or 25.1.3.0/25.1.3.1.\u003c/li\u003e\n\u003cli\u003eInitiate incident response procedures if unauthorized access is suspected, as patching does not remediate established backdoors or persistence.\u003c/li\u003e\n\u003cli\u003eMonitor logs for unusual authentication activity or unexpected process execution occurring on the Connect Secure appliance.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T17:36:33Z","date_published":"2026-10-13T16:47:01Z","id":"https://feed.craftedsignal.io/briefs/2026-10-ivanti-connect-secure-rce/","summary":"An unauthenticated remote code execution vulnerability (CVE-2026-104935) in Ivanti Connect Secure is being actively exploited in the wild, enabling attackers to gain control over affected systems.","title":"Remote Code Execution Vulnerability in Ivanti Connect Secure","url":"https://feed.craftedsignal.io/briefs/2026-10-ivanti-connect-secure-rce/"},{"_cs_actors":["Integrity Technology Group"],"_cs_cpes":["cpe:2.3:a:proftpd:proftpd:1.3.5:*:*:*:*:*:*:*","cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:connect_secure:8.2:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:connect_secure:8.3:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:connect_secure:9.0:*:*:*:*:*:*:*","cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","cpe:2.3:a:onlyoffice:document_server:*:*:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2015-3306"},{"id":"CVE-2015-5477"},{"cvss":10,"id":"CVE-2019-11510"},{"cvss":10,"id":"CVE-2021-22205"},{"cvss":9.8,"id":"CVE-2021-3199"},{"cvss":4.9,"id":"CVE-2023-22894"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Bash","ProFTPD (\u003c 9.9.7-P2)","BIND (\u003c 9.9.7-P2)","Struts","Connect Secure","GitLab","Document Server","Strapi","Exchange Server","Microsoft 365","ScreenOS","Jenkins","WebLogic Server"],"_cs_severities":["high"],"_cs_tags":["espionage","china","cyber-espionage","microsoft-365","dcsync"],"_cs_type":"threat","_cs_vendors":["GNU","ProFTPD","ISC","Apache","Pulse Secure","GitLab","ONLYOFFICE","Strapi","Microsoft","Juniper Networks","Jenkins","Oracle"],"content_html":"\u003cp\u003eIntegrity Technology Group, a China-based for-profit company linked to state security agencies, has conducted widespread espionage against government, law enforcement, healthcare, and religious institutions across Southeast Asia, Africa, and North America since at least 2021. The group leverages a diverse set of penetration testing scripts and automated scanning tools to identify and exploit vulnerabilities in legacy services and web applications. Beyond exploitation, they utilize password spraying against Microsoft 365 and Exchange environments, coupled with XSS-based phishing to harvest credentials.\u003c/p\u003e\n\u003cp\u003eThe group maintains persistence through disguised legitimate software and exfiltrates sensitive email content via custom bots and tools that interface directly with Exchange Web Services. Notably, the group facilitates third-party access to stolen data via a specialized web portal, indicating a high-level operational model that prioritizes data monetization or dissemination. US and UK authorities have sanctioned the group for its role in targeting critical infrastructure. Defenders should prioritize auditing Active Directory replication, monitoring Exchange interface access, and patching the documented vulnerabilities exploited by the group.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial Reconnaissance: Attackers scan for exposed services (ports 21, 22, 53, 80, 443, 1080) using tools like Nmap, masscan, and MicroScan (containing 1,300+ penetration scripts).\u003c/li\u003e\n\u003cli\u003eInitial Access: Attackers exploit known vulnerabilities (CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199, CVE-2023-22894) or perform password spraying against Microsoft 365/Exchange interfaces.\u003c/li\u003e\n\u003cli\u003eCredential Harvesting: Actors deploy XSS payloads on legitimate web pages to redirect users to fake login portals to steal usernames and passwords, or use EBurst to brute-force authentication.\u003c/li\u003e\n\u003cli\u003ePersistence: Attackers install SoftEther VPN, renaming the binary to 'conhost.exe' or 'dllhost.exe' to mimic Windows system processes and establishing persistence upon system reboot.\u003c/li\u003e\n\u003cli\u003eCredential Access: Attackers execute 'DC.exe' to leverage the DCSync technique, extracting account credentials and trust relationships from domain controllers.\u003c/li\u003e\n\u003cli\u003eCollection: Attackers deploy the PHP script 'Curlc4.txt' or the 'office-cli' utility to interface with Exchange Web Services (EWS) and copy sensitive mailboxes.\u003c/li\u003e\n\u003cli\u003eExfiltration: Stolen email content is compressed and uploaded to attacker-controlled C2 infrastructure, such as 'natcloudservice.com'.\u003c/li\u003e\n\u003cli\u003eImpact: Stolen information is ingested into a web-based portal to provide third-party access to the intelligence, affecting diverse sectors including law enforcement and healthcare.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis campaign has resulted in the theft of high-value communications from government agencies, law enforcement, healthcare systems, and religious organizations globally. By enabling third-party access to stolen emails through a web portal, the threat actor significantly increases the potential for downstream exploitation and geopolitical intelligence leverage. The duration of the campaign, active since 2021, suggests large-scale, long-term exposure of sensitive data across multiple continents.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBlock known malicious C2 domains including 'dns.studiocloud.xyz' and 'natcloudservice.com' at the DNS resolver level.\u003c/li\u003e\n\u003cli\u003ePatch the 8 identified vulnerabilities (CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199, CVE-2023-22894) across all perimeter and internal services.\u003c/li\u003e\n\u003cli\u003eEnforce MFA across all Microsoft 365, VPN, and critical email infrastructure.\u003c/li\u003e\n\u003cli\u003eAudit Active Directory for anomalous replication events associated with the DCSync technique (e.g., unexpected 'GetNCChanges' calls).\u003c/li\u003e\n\u003cli\u003eReview web server logs for suspicious MicroScan patterns or XSS injection attempts.\u003c/li\u003e\n\u003cli\u003eMonitor process creation for 'conhost.exe' or 'dllhost.exe' originating from non-system paths, specifically those associated with VPN binary signatures.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-08T19:12:19Z","date_published":"2026-10-08T19:12:19Z","id":"https://feed.craftedsignal.io/briefs/2026-10-integrity-technology-espionage/","summary":"Integrity Technology Group, a Chinese for-profit entity, is conducting multi-year cyber espionage targeting government, healthcare, and religious institutions using automated vulnerability scanning, credential harvesting, and specialized data exfiltration tools.","title":"China-Linked Espionage Campaign Targeting Global Infrastructure via Integrity Technology Group","url":"https://feed.craftedsignal.io/briefs/2026-10-integrity-technology-espionage/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ivanti:connect_secure:9.0:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:connect_secure:9.1:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:connect_secure:22.1:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:connect_secure:22.2:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:connect_secure:22.3:r1:*:*:*:*:*:*","cpe:2.3:a:ivanti:connect_secure:22.4:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:connect_secure:22.5:r2.1:*:*:*:*:*:*","cpe:2.3:a:ivanti:connect_secure:22.6:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:policy_secure:9.0:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:policy_secure:9.1:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:policy_secure:22.1:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:policy_secure:22.2:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:policy_secure:22.3:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:policy_secure:22.4:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:policy_secure:22.5:*:*:*:*:*:*:*","cpe:2.3:a:ivanti:policy_secure:22.6:r1:*:*:*:*:*:*","cpe:2.3:a:wpmet:wp_ultimate_review:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2023-46805"},{"cvss":9.1,"id":"CVE-2024-21887"},{"cvss":4.3,"id":"CVE-2023-46085"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Connect Secure"],"_cs_severities":["high"],"_cs_tags":["ivanti","cve-2023-46805","cve-2024-21887","vpn","exploitation","command-injection","authentication-bypass"],"_cs_type":"advisory","_cs_vendors":["Ivanti"],"content_html":"\u003cp\u003eThis threat brief addresses exploitation attempts targeting Ivanti Connect Secure VPN appliances, specifically focusing on CVE-2023-46805 and CVE-2024-21887. These vulnerabilities allow for authentication bypass and command injection, potentially leading to unauthenticated remote code execution. The attacks target a specific endpoint related to web bookmarks, \u003ccode\u003e/api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark\u003c/code\u003e. Detection focuses on identifying anomalous GET requests to this endpoint that result in a 403 Forbidden response. Successful exploitation grants attackers unauthorized access to the system, allowing them to execute commands, steal sensitive data, or deploy malicious payloads. Due to the critical nature of VPN appliances in network security, defenders must prioritize detecting and mitigating these exploitation attempts.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker sends a crafted GET request to the vulnerable endpoint: \u003ccode\u003e/api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDue to the vulnerabilities (CVE-2023-46805 and CVE-2024-21887), the authentication checks are bypassed.\u003c/li\u003e\n\u003cli\u003eThe server processes the malicious request and attempts to access or modify web bookmark configurations.\u003c/li\u003e\n\u003cli\u003eDue to improper input validation, a command injection vulnerability is triggered, allowing the attacker to inject arbitrary commands.\u003c/li\u003e\n\u003cli\u003eThe server returns a \u003ccode\u003e403 Forbidden\u003c/code\u003e HTTP status code, indicating the request was blocked after the attempted exploitation. The response body is often empty.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages the command execution to perform reconnaissance activities, such as gathering system information using tools like \u003ccode\u003euname\u003c/code\u003e or \u003ccode\u003eipconfig\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker attempts to establish persistence by creating new user accounts or modifying existing VPN configurations.\u003c/li\u003e\n\u003cli\u003eFinally, the attacker achieves their objective, which may include data exfiltration, lateral movement within the network, or deploying ransomware.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2023-46805 and CVE-2024-21887 can lead to complete compromise of the Ivanti Connect Secure VPN appliance. This can result in unauthorized access to sensitive internal resources, data breaches, and disruption of VPN services. Given that VPNs are a critical component of network security, a successful attack can have widespread consequences. The number of affected organizations is potentially very high, with victims spanning multiple sectors, including government, finance, and critical infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect Ivanti Connect Secure Bookmark Endpoint Access\u003c/code\u003e to identify potential exploitation attempts based on HTTP GET requests with 403 responses targeting the specific bookmark endpoint.\u003c/li\u003e\n\u003cli\u003eInspect web server logs for requests matching the pattern \u003ccode\u003e*/api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark*\u003c/code\u003e with a \u003ccode\u003e403\u003c/code\u003e status code, as described in the overview.\u003c/li\u003e\n\u003cli\u003eInvestigate any alerts triggered by the provided Sigma rule or identified through manual log analysis, focusing on the source IP address (\u003ccode\u003eWeb.src\u003c/code\u003e in the provided search query) and destination system (\u003ccode\u003eWeb.dest\u003c/code\u003e in the provided search query).\u003c/li\u003e\n\u003cli\u003eApply the official patches and mitigations provided by Ivanti for CVE-2023-46805 and CVE-2024-21887 on all affected Ivanti Connect Secure VPN appliances immediately, as this is the most effective way to prevent exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T17:40:53Z","date_published":"2024-04-29T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-04-ivanti-connect-secure-bookmark-endpoint/","summary":"Detection of access to the Ivanti Connect Secure bookmark endpoint associated with CVE-2023-46805 and CVE-2024-21887 via a GET request resulting in a 403 Forbidden response indicates a potential exploitation attempt.","title":"Detection of Exploitation Attempts Targeting Ivanti Connect Secure Bookmark Endpoint Vulnerabilities","url":"https://feed.craftedsignal.io/briefs/2024-04-ivanti-connect-secure-bookmark-endpoint/"}],"language":"en","title":"CraftedSignal Threat Feed - Connect Secure","version":"https://jsonfeed.org/version/1.1"}