Impact

The vulnerability allows for full system control by unauthorized actors, potentially leading to widespread data exfiltration, lateral movement within the network, and the deployment of additional malicious tools. The vulnerability is being exploited in the wild against a limited number of customers. The NCSC classifies both the risk of exploitation and the potential damage as high.

Recommendation

• Identify the current version of Ivanti Connect Secure and verify it against the patches listed by Ivanti.
• Apply the relevant security update immediately. For the 22.8 series, update to 22.8R2.5 or migrate to the 25.1 branch (25.1.1.2 or newer). For the 25.1 series, update to 25.1.1.2, 25.1.2.2 (if supported by migration path), or 25.1.3.0/25.1.3.1.
• Initiate incident response procedures if unauthorized access is suspected, as patching does not remediate established backdoors or persistence.
• Monitor logs for unusual authentication activity or unexpected process execution occurring on the Connect Secure appliance.

The group maintains persistence through disguised legitimate software and exfiltrates sensitive email content via custom bots and tools that interface directly with Exchange Web Services. Notably, the group facilitates third-party access to stolen data via a specialized web portal, indicating a high-level operational model that prioritizes data monetization or dissemination. US and UK authorities have sanctioned the group for its role in targeting critical infrastructure. Defenders should prioritize auditing Active Directory replication, monitoring Exchange interface access, and patching the documented vulnerabilities exploited by the group.

Attack Chain

1. Initial Reconnaissance: Attackers scan for exposed services (ports 21, 22, 53, 80, 443, 1080) using tools like Nmap, masscan, and MicroScan (containing 1,300+ penetration scripts).
2. Initial Access: Attackers exploit known vulnerabilities (CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199, CVE-2023-22894) or perform password spraying against Microsoft 365/Exchange interfaces.
3. Credential Harvesting: Actors deploy XSS payloads on legitimate web pages to redirect users to fake login portals to steal usernames and passwords, or use EBurst to brute-force authentication.
4. Persistence: Attackers install SoftEther VPN, renaming the binary to 'conhost.exe' or 'dllhost.exe' to mimic Windows system processes and establishing persistence upon system reboot.
5. Credential Access: Attackers execute 'DC.exe' to leverage the DCSync technique, extracting account credentials and trust relationships from domain controllers.
6. Collection: Attackers deploy the PHP script 'Curlc4.txt' or the 'office-cli' utility to interface with Exchange Web Services (EWS) and copy sensitive mailboxes.
7. Exfiltration: Stolen email content is compressed and uploaded to attacker-controlled C2 infrastructure, such as 'natcloudservice.com'.
8. Impact: Stolen information is ingested into a web-based portal to provide third-party access to the intelligence, affecting diverse sectors including law enforcement and healthcare.

Impact

This campaign has resulted in the theft of high-value communications from government agencies, law enforcement, healthcare systems, and religious organizations globally. By enabling third-party access to stolen emails through a web portal, the threat actor significantly increases the potential for downstream exploitation and geopolitical intelligence leverage. The duration of the campaign, active since 2021, suggests large-scale, long-term exposure of sensitive data across multiple continents.

Recommendation

• Block known malicious C2 domains including 'dns.studiocloud.xyz' and 'natcloudservice.com' at the DNS resolver level.
• Patch the 8 identified vulnerabilities (CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199, CVE-2023-22894) across all perimeter and internal services.
• Enforce MFA across all Microsoft 365, VPN, and critical email infrastructure.
• Audit Active Directory for anomalous replication events associated with the DCSync technique (e.g., unexpected 'GetNCChanges' calls).
• Review web server logs for suspicious MicroScan patterns or XSS injection attempts.
• Monitor process creation for 'conhost.exe' or 'dllhost.exe' originating from non-system paths, specifically those associated with VPN binary signatures.

Attack Chain

1. The attacker sends a crafted GET request to the vulnerable endpoint: /api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark.
2. Due to the vulnerabilities (CVE-2023-46805 and CVE-2024-21887), the authentication checks are bypassed.
3. The server processes the malicious request and attempts to access or modify web bookmark configurations.
4. Due to improper input validation, a command injection vulnerability is triggered, allowing the attacker to inject arbitrary commands.
5. The server returns a 403 Forbidden HTTP status code, indicating the request was blocked after the attempted exploitation. The response body is often empty.
6. The attacker leverages the command execution to perform reconnaissance activities, such as gathering system information using tools like uname or ipconfig.
7. The attacker attempts to establish persistence by creating new user accounts or modifying existing VPN configurations.
8. Finally, the attacker achieves their objective, which may include data exfiltration, lateral movement within the network, or deploying ransomware.

Impact

Successful exploitation of CVE-2023-46805 and CVE-2024-21887 can lead to complete compromise of the Ivanti Connect Secure VPN appliance. This can result in unauthorized access to sensitive internal resources, data breaches, and disruption of VPN services. Given that VPNs are a critical component of network security, a successful attack can have widespread consequences. The number of affected organizations is potentially very high, with victims spanning multiple sectors, including government, finance, and critical infrastructure.

Recommendation

• Deploy the Sigma rule Detect Ivanti Connect Secure Bookmark Endpoint Access to identify potential exploitation attempts based on HTTP GET requests with 403 responses targeting the specific bookmark endpoint.
• Inspect web server logs for requests matching the pattern */api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark* with a 403 status code, as described in the overview.
• Investigate any alerts triggered by the provided Sigma rule or identified through manual log analysis, focusing on the source IP address (Web.src in the provided search query) and destination system (Web.dest in the provided search query).
• Apply the official patches and mitigations provided by Ivanti for CVE-2023-46805 and CVE-2024-21887 on all affected Ivanti Connect Secure VPN appliances immediately, as this is the most effective way to prevent exploitation.