Hunting Ivanti Connect Secure Zero-Days: From Auth Bypass to Implant, With IoCs and Log Sources
Rapid7 is warning about two more Ivanti Connect Secure zero-days under active exploitation. This short walks through the documented pattern from earlier ICS waves: pre-auth access, web shell, implant, then a pivot into identity. It ranks the cheapest triage checks first, shows why paired web-root file changes matter, and explains why patching is not cleanup: verify the build, run the integrity check, rotate secrets and SAML certificates, invalidate active VPN sessions, and if you cannot patch, remove the admin console from internet reachability and forward full logs today. The source does not assign unverified CVE IDs or publish exploitation mechanics for the new bugs. Read the full write-up for the triage queries and log sources: https://hackyjs.com/posts/hunting-ivanti-connect-secure-zero-days-from-auth-bypass-to-implant-with-iocs-and-log-sources