Tag: zero-day
-
Week in review: Exploited Ivanti Connect Secure zero-day, Patch Tuesday forecast
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Ivanti Connect Secure zero-day exploited by attackers (CVE-2025-0282) Ivanti … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/01/12/week-in-review-exploited-ivanti-connect-secure-zero-day-patch-tuesday-forecast/
-
Mandiant links Ivanti zero-day exploitation to Chinese hackers
Mandiant warned users to be prepared for widespread exploitation of CVE-2025-0282 as Ivanti products have become a popular target for attackers in recent years. First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366617826/Mandiant-links-Ivanti-zero-day-exploitation-to-Chinese-hackers
-
Ivanti zero-day exploited by APT group that previously targeted Connect Secure appliances
Researchers from Google’s Mandiant division believe the critical remote code execution vulnerability patched on Wednesday by software vendor Ivanti has been exploited since mid-December by a Chinese cyberespionage group. This is the same group that has exploited zero-day vulnerabilities in Ivanti Connect Secure appliances back in January 2024 and throughout the year.The latest attacks, exploiting…
-
Ivanti zero-day attacks infected devices with custom malware
Hackers exploiting the critical Ivanti Connect Secure zero-day vulnerability disclosed yesterday installed on compromised VPN appliances new malware called ‘Dryhook’ and ‘Phasejam’ that is not currently associated with any threat group. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/google-chinese-hackers-likely-behind-ivanti-vpn-zero-day-attacks/
-
Active exploitation of Ivanti Connect Secure zero-day ongoing
First seen on scworld.com Jump to article: www.scworld.com/brief/active-exploitation-of-ivanti-connect-secure-zero-day-ongoing
-
Hackers take Pride in exploiting Four-Faith zero day
First seen on scworld.com Jump to article: www.scworld.com/news/hackers-take-pride-in-exploiting-four-faith-zero-day
-
Breach Roundup: Finland Detains Tanker Tied to Cable Sabotage
Also, Alleged Gravy Analytics Breach Exposes Location Data. This week, a Russian tanker linked to cable sabotage detained in Finland, a claimed Gravy Analytics breach exposed location data, a Mirai-based botnet exploited zero-day flaws, Dell updated framework flaws and a court sentenced a Florida woman for laundering millions in romance scams. First seen on govinfosecurity.com…
-
New Mirai botnet targets industrial routers
Tags: access, attack, botnet, cctv, china, credentials, cve, cybercrime, data, ddos, exploit, germany, network, password, remote-code-execution, router, russia, update, vulnerability, zero-dayAccording to security analysis, the Gayfemboy botnet, based on the notorious Mirai malware, is currently spreading around the world. Researchers from Chainxin X Lab found that cybercriminals have been using the botnet since November 2024 to attack previously unknown vulnerabilities. The botnet’s preferred targets include Four-Faith and Neterbit routers or smart home devices.Experts from VulnCheck reported at the end of…
-
New zero-day exploit targets Ivanti VPN product
Mandiant says it found malware in impacted devices associated with a Chinese-linked threat group. First seen on cyberscoop.com Jump to article: cyberscoop.com/ivanti-vpn-vulnerabilities-zero-day-exploit-china-cisa/
-
Ivanti customers confront new zero-day with suspected nation-state nexus
The latest attacks come one year after a threat group exploited a pair of zero-days in the same Ivanti product. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/ivanti-zero-day-attacks/736932/
-
Chinese hackers likely behind Ivanti VPN zero-day attacks
Hackers exploiting the critical Ivanti Connect Secure zero-day vulnerability disclosed yesterday installed on compromised VPN appliances new malware called ‘Dryhook’ and ‘Phasejam’ that is not currently associated with any threat group. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/google-chinese-hackers-likely-behind-ivanti-vpn-zero-day-attacks/
-
Ivanti Discloses Exploitation Of ‘Critical’ VPN Vulnerability
Ivanti’s Connect Secure VPN is vulnerable to a critical-severity zero-day vulnerability that has been exploited in attacks as well as a second, high-severity flaw, the company says. First seen on crn.com Jump to article: www.crn.com/news/security/2025/ivanti-discloses-exploitation-of-critical-vpn-vulnerability
-
Zero-day exploits plague Ivanti Connect Secure appliances for second year running
Factory resets and apply patches is the advice amid fortnight delay for other appliances First seen on theregister.com Jump to article: www.theregister.com/2025/01/09/zeroday_exploits_ivanti/
-
Critical Ivanti Connect Secure zero-day flaw under attack
Although Ivanti has seen exploitation of CVE-2025-0282 in only Ivanti Connect Secure instances, Ivanti Policy Secure and ZTA gateways are also vulnerable to the flaw. First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366617819/Critical-Ivanti-Connect-Secure-zero-day-flaw-under-attack
-
Ivanti Connect Secure zero-day exploited since mid-December (CVE-2025-0282)
The zero-day attacks leveraging the Ivanti Connect Secure (ICS) vulnerability (CVE-2025-0282) made public on Wednesday were first spotted in mid-December 2024, Mandiant … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/01/09/ivanti-cve-2025-0282-zero-day-attacks-indicators-of-compromise/
-
Zero-Day Patch Alert: Ivanti Connect Secure Under Attack
Suspected Chinese Attackers Again Tied to Active Exploitation of VPN Appliances. VPN appliance maker Ivanti has begun releasing updates to patch a zero-day vulnerability being actively exploited by suspected nation-state attackers. Experts are warning users to immediately update their devices, after factory resetting them to flush any malware attackers may have installed. First seen on…
-
Exploitation of New Ivanti VPN Zero-Day Linked to Chinese Cyberspies
Google Cloud’s Mandiant has linked the exploitation of CVE-2025-0282, a new Ivanti VPN zero-day, to Chinese cyberspies. The post Exploitation of New Ivanti VPN Zero-Day Linked to Chinese Cyberspies appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/exploitation-of-new-ivanti-vpn-zero-day-linked-to-chinese-cyberspies/
-
Critical Ivanti Zero-Day Exploited in the Wild
Ivanti customers are urged to patch two new bugs in the security vendor’s products, one of which is being actively exploited First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/critical-ivanti-zeroday-exploited/
-
SOAR buyer’s guide: 11 security orchestration, automation, and response products, and how to choose
Tags: access, ai, api, attack, automation, business, chatgpt, cisco, cloud, compliance, container, cybersecurity, data, detection, edr, endpoint, firewall, fortinet, gartner, google, group, guide, Hardware, ibm, incident response, infrastructure, intelligence, jobs, LLM, malware, mandiant, marketplace, microsoft, mitigation, monitoring, network, okta, risk, saas, security-incident, service, siem, soar, soc, software, technology, threat, tool, training, vulnerability, vulnerability-management, zero-daySecurity orchestration, automation, and response (SOAR) has undergone a major transformation in the past few years. Features in each of the words in its description that were once exclusive to SOAR have bled into other tools. For example, responses can be found now in endpoint detection and response (EDR) tools. Orchestration is now a joint…
-
Ivanti 0-Day Vulnerability Exploited in Wild-Patch Now
Ivanti released a critical security advisory addressing vulnerabilities in its Connect Secure, Policy Secure, and ZTA Gateways products. This advisory reveals the existence of two significant vulnerabilities, CVE-2025-0282 and CVE-2025-0283, which have been exploited in the wild, necessitating immediate action from users. Critical Vulnerability: CVE-2025-0282 CVE-2025-0282 is a stack-based buffer overflow vulnerability that affects Ivanti…
-
Mirai Botnet Variant Exploits Zero-Day Vulnerabilities in Routers
Researchers observed the Gayfemboy botnet in early 2024 as a basic Mirai variant. Still, the botnet rapidly evolved through iterative development, including UPX polymorphic packing, integrating N-day vulnerabilities, and ultimately leveraging a 0-day vulnerability in Four-Faith industrial routers. By November 2024, Gayfemboy had infected over 15,000 devices, utilizing over 40 grouping categories for command and…
-
Ivanti warns critical RCE flaw in Connect Secure exploited as zero-day
Tags: advisory, apt, attack, authentication, cve, cvss, cybersecurity, data-breach, exploit, flaw, google, government, group, intelligence, Internet, ivanti, law, mandiant, microsoft, network, rce, remote-code-execution, risk, software, threat, tool, vpn, vulnerability, zero-dayIT software provider Ivanti released patches Wednesday for its Connect Secure SSL VPN appliances to address two memory corruption vulnerabilities, one of which has already been exploited in the wild as a zero-day to compromise devices.The exploited vulnerability, tracked as CVE-2025-0282, is a stack-based buffer overflow rated as critical with a CVSS score of 9.0.…
-
Zero-Day Alert: UNC5337 Exploits Ivanti VPN Vulnerability CVE-2025-0282 for Espionage Operations
Ivanti Connect Secure (ICS) VPN appliances have become the focus of advanced threat actors, exploiting a newly disclosed First seen on securityonline.info Jump to article: securityonline.info/zero-day-alert-unc5337-exploits-ivanti-vpn-vulnerability-cve-2025-0282-for-espionage-operations/
-
CVE-2025-0282: Ivanti Connect Secure Zero-Day Vulnerability Exploited In The Wild
Tags: access, advisory, attack, authentication, cve, exploit, flaw, group, injection, ivanti, malware, ransomware, remote-code-execution, threat, tool, update, vulnerability, zero-day, zero-trustIvanti disclosed two vulnerabilities in its Connect Secure, Policy Secure and Neurons for ZTA gateway devices, including one flaw that was exploited in the wild as a zero-day. Background On January 8, Ivanti published a security advisory for two vulnerabilities affecting multiple products including Ivanti Connect Secure, Ivanti Policy Secure and Ivanti Neurons for Zero…
-
Mitel 0-day, 5-year-old Oracle RCE bug under active exploit
3 CVEs added to CISA’s catalog First seen on theregister.com Jump to article: www.theregister.com/2025/01/08/mitel_0_day_oracle_rce_under_exploit/
-
Ivanti warns of new Connect Secure flaw used in zero-day attacks
Ivanti is warning that a new Connect Secure remote code execution vulnerability tracked as CVE-2025-0282 was exploited in zero-day attacks to install malware on appliances. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ivanti-warns-of-new-connect-secure-flaw-used-in-zero-day-attacks/
-
Industrial router zero-day leveraged by new Mirai-based botnet
First seen on scworld.com Jump to article: www.scworld.com/brief/industrial-router-zero-day-leveraged-by-new-mirai-based-botnet