Attackers chained three zero-day flaws in Ivanti Connect Secure VPN appliances to gain root-level access without logging in, then searched for credentials and sensitive Active Directory data.

The activity, which began on October 3, 2026, targeted a fully patched appliance running version 22.8R2.4, showing that keeping a device current did not protect it from these previously unknown flaws.

Volexity found the intrusion while investigating suspicious activity at a customer and worked with Ivanti to examine the affected device. The security firm tracks the previously unknown actor as UTA0576.

Its analysis found attempts to steal domain credentials, Local Administrator Password Solution (LAPS) passwords, BitLocker recovery keys, and other directory information.

Researcers at Volexity found that the chain combined an authentication bypass and a file-write weakness that Ivanti tracks together as CVE-2026-104935, followed by a separate privilege-escalation flaw.

The first two issues let the attacker reach a protected script and run code as the appliance’s cgi-server user. The third flaw then let UTA0576 run commands as root.

Ivanti released a fix for CVE-2026-104935 on October 13, while the privilege-escalation issue remained under development for a future update.

Ivanti Connect Secure 0-Days Exploited

Volexity said the initial bypass misused the appliance’s handling of web requests. A request to a public login script could include an X-DSCGI-PATH header that directed the appliance to a different, protected script.

The attacker then abused the file-upload handler to briefly place a script on the device. By sending repeated requests quickly, UTA0576 could run the file before the appliance deleted it.

After gaining initial code execution, the actor used the privileged dsinvoked service to raise access to root. The exploit changed configuration data in memory, asked the service to run a task with an attacker-supplied script, and then restored the original settings.

It also removed selected entries from Ivanti debug and Linux audit logs. Because the changes happened in memory and were reversed, Ivanti’s Integrity Checker Tool might not show signs of compromise.

The actor did not install a web shell or backdoor, according to Volexity. Instead, it sent commands through the same HTTPS exploit channel and received results in the responses.

This made the activity harder to spot through a search for persistent malware alone. Organizations following the full Ivanti zero-day report should note that a clean file scan or the absence of a web shell cannot by itself rule out an intrusion.

Once inside, UTA0576 used the VPN appliance’s Active Directory service account to query a domain controller over LDAP. The searches included LAPS passwords, BitLocker recovery data, password-bearing account fields, logon script paths, and other user details.

The actor also extracted credentials stored on the appliance, reviewed authentication logs for valid usernames, and tried password spraying against Active Directory accounts.

The operation also included network discovery and data collection. A packet-capture tool searched traffic for LDAP credentials, HTTP Basic Authentication credentials, and NTLM challenge-response hashes.

Lateral movement

The actor attempted to export captured traffic and directory results through the exploit channel. Volexity assessed with high confidence that the activity pointed to preparation for lateral movement, though the investigation did not establish the actor’s ultimate goal.

This focus on VPN appliances and directory credentials echoes other activity Volexity has investigated, including the SonicWall VPN credential theft campaign.

The incidents involved different products and threat actors, but both show why edge devices can expose sensitive internal traffic. They should not be treated as the same campaign.

Administrators should install the latest Ivanti update that applies to their appliance and investigate devices that may have been exposed.

Volexity recommends watching for repeated requests to /dana-na/auth/url_default/welcome.cgi, especially when the X-DSCGI-PATH value points to a different location.

Teams should also check for unusual files and activity under /tmp/ and review network evidence. Suspected cases need memory and network forensics because log tampering and memory-only changes can hide traces from routine checks.

Volexity published indicators related to the case, but its report does not provide file SHA values. The listed address and artifacts below come from the report; they are clues to investigate, not proof on their own that a device was compromised.

Indicators of compromise (IoCs):-

Type	Indicator	Context
IP address	`108.165.147[.]64`	Host used in the operation; Volexity identified it as an Evoxt VPS running an OpenVPN server during the observed period.
Web path	`/dana-na/auth/url_default/welcome.cgi`	Public login script used in the exploit chain.
HTTP header	`X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi`	Example header directing a request to the protected upload handler.
HTTP header pattern	`X-DSCGI-PATH: /home/runtime/tmp/`	Example target path used to try to run the temporary uploaded script.
File path	`/data/.icscap/h.py`	Packet-capture parsing script found during the investigation.
File path	`/tmp/ml.py`, `/tmp/rq5.py`	Custom LDAP tool and related script.
File path	`/tmp/mk.py`, `/tmp/rr.py`	Kerberos testing tool and accompanying script.
File path	`/tmp/sp_out.txt`, `/tmp/spray_hits.json`	Files linked to password-spraying activity.
Process name	`dsstatmond`	Renamed packet-capture tool observed running from the hidden `.icscap` directory.
SHA values	Not listed in the Volexity report	No file hashes are included here because the cited source does not provide them.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Ivanti Connect Secure 0-Days Exploited to Steal Active Directory Credentials appeared first on Cyber Security News.