A previously unknown threat actor (Volexity tracks it as UTA0576) has been actively exploiting a chain of three zero-days in Ivanti Connect Secure (ICS) VPN appliances since 3 October to achieve unauthenticated root-level remote code execution, including against the recent fully patched build 22.8R2.4. The chain combines an authentication bypass and a race-condition remote code execution (both tracked as CVE-2026-104935, fixed in the 13 October patches) with a privilege-escalation flaw in how the dsinvoked broker trusts DSCache configuration — the third component remains unpatched, with Ivanti targeting it for "the coming weeks". Post-exploitation focused on credential theft from Active Directory: Volexity observed a custom Kerberos tool for Kerberoasting, LAPS password and BitLocker recovery-key hunts via LDAP, password spraying and exfiltration of AD metadata. The actor used in-memory-only implants and deleted its own Ivanti debug and Linux audit log entries, defeating Ivanti's Integrity Checker Tool and making forensic discovery necessary. CISA added CVE-2026-104935 to the KEV catalogue on 13 October. Organisations running ICS should patch immediately, treat the unpatched privilege escalation as a live risk, and forensically investigate any instance where lateral movement from the VPN device is suspected.

• Source article