Post

Volexity has discovered in-the-wild exploitation of a zero-day exploit chain targeting Ivanti Connect Secure VPN appliances (CVE-2026-104935). The threat actor, UTA0576, chained three vulnerabilities to gain unauthenticated root-level code execution.   #DFIR #threatintel

volexity.comA Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-DaysVolexity has identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices. Ivanti has published an advisory p...

Volexity

@volexity.com

Notably, UTA0576 deployed no malware or web shell. Instead, they re-exploited the device for every command, returned results through HTTPS responses, and tampered with logs to stay hidden, evading Ivanti’s Integrity Checker Tool.

13/10/26, 3:50 pm0 reposts1 like

Volexity

@volexity.com

Volexity used its #Volcano memory analysis platform to uncover the full exploit chain and the attacker’s post-exploitation activity. Read the blog post for the full analysis, detection guidance & IOCs.