Ivanti VPN Vulnerability: Mitigation Strategies, Incident Response, and Defense

Unit 42 Incident Response Cases

The exploitation campaigns of the CVE-2023-46805 and CVE-2024-21887 Ivanti vulnerabilities occurred in three distinct waves.

The first wave lasted from at least the second week of December 2023 to Jan. 10, 2024, when Volexity published their first blog post on the matter. The attacks in this campaign were targeted and featured multiple custom web shells and lateral movement. Unit 42 responded to threat activity that likely corresponded to this wave of campaigns.

Similar to the activity discussed in Volexity’s blog post, we observed the threat actor performing the following activities:

• Archiving files including NTDS.dit using 7-Zip before exfiltration
• Creating a memory dump of the LSASS process using Windows Task Manager (Taskmgr.exe)
• Moving laterally via remote desktop protocol (RDP)
• Deleting logs

The second wave began after Volexity’s first blog post on Jan. 10, 2024. This wave was marked by a shift from targeted attacks to mass exploitation by additional threat actors.

Unit 42 responded to cases of threat activity that likely corresponded to this wave of campaigns. The threat activity was consistent across these cases.

The threat actor dumped configuration data containing schema, settings, names and credentials of the various users and accounts within the network, but did not perform any lateral movements like the incidents that occurred in the first wave.

Unit 42 believes that the threat actors behind this activity might have shifted focus to wider exploitation to maximize impact before organizations could begin patching and applying mitigation guidance.

The third wave began as early as Jan. 16, 2024, when proof-of-concept (PoC) exploits became publicly available. The release of these exploits lead to mass exploitation by a range of actors with various motivations and degrees of sophistication, including criminal entities widely deploying cryptominers and various remote monitoring and management (RMM) software.

Unit 42 has responded to threat activity that likely corresponded to this wave, from a threat actor using a publicly available PoC exploit. We are currently supporting our clients investigating those incidents.

Comprehensive Ivanati Defense Strategies

The discovery of these vulnerabilities underscores the need for vigilant security measures and rapid response capabilities. This has highlighted critical security vulnerabilities within widely used virtual private network (VPN) technologies exploited by sophisticated threat actors. These vulnerabilities allow unauthorized access and control, posing significant risks to organizational networks.

The following strategies are critical for maintaining a strong security posture against evolving cyberthreats, ensuring the protection of sensitive information and critical infrastructure:

• Inventory your assets: Catalog all network devices, systems and software.
• Choose the right tools: Utilize vulnerability scanning tools that best fit your IT environment's complexity and scale.
• Scan for vulnerabilities: Regularly run scans to identify security weaknesses in your systems.
• Analyze the results: Carefully review scan results to prioritize vulnerabilities based on their severity and potential impact.
• Remediate and patch: Apply necessary patches or workarounds to mitigate identified vulnerabilities.
• Repeat and review: Monitor and reassess your security posture to adapt to new threats.

Be sure to check our advanced Ivanti Emerging Threat Report:

Adopting a Comprehensive Cybersecurity Strategy

Taking significant measures to protect your network from potential cyberthreats is essential. Some methods to safeguard your network include hiding applications and VPNs from public internet visibility to shield them from attackers. You should also thoroughly inspect all inbound and outbound traffic to neutralize threats such as malware and zero-day exploits.

Applying the principle of least privilege across your network is another vital step. This ensures that users can only access resources necessary for their roles. You should also strengthen access controls by using robust multifactor authentication to verify user identities effectively.

Connecting users directly to applications rather than the broader network is also recommended. This minimizes potential damage from security incidents. Utilizing continuous monitoring is also essential to identify and mitigate threats posed by compromised insiders or external actors.

To protect sensitive data, diligent monitoring and encryption should be applied both in transit and at rest. Employing deception technologies and proactive threat hunting can help identify and neutralize threats before they can cause harm.

Fostering a culture of security awareness within your organization can also defend against common vectors like phishing. Regularly evaluating your security measures through assessments and simulations can help identify and address vulnerabilities.

Palo Alto Networks Zero Trust Approach

In response to these threats, Palo Alto Networks emphasizes the criticality of a Zero Trust architecture, providing secure, segmented access to applications without exposing them to direct internet threats. Our solutions, including advanced threat prevention and segmentation policies, are designed to minimize the attack surface, prevent unauthorized access, and detect and respond to threats in real-time.

10 FAQ questions and answers about Ivanti Vulnerability for enterprise security professionals