CISA cautions against using hacked Ivanti VPN gateways even after factory resets

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) revealed today that attackers who hack Ivanti VPN appliances using one of multiple actively exploited vulnerabilities may be able to maintain root persistence even after performing factory resets. Furthermore, they can also evade detection by Ivanti's internal and external Integrity Checker Tool (ICT) on Ivanti Connect Secure and Policy Secure gateways compromised using CVE-2023-46805, CVE-2024-21887, CVE-2024-22024, and CVE-2024-21893 exploits. The four vulnerabilities' severity ratings range from high to critical, and they can be exploited for authentication bypass, command injection, server-side-request forgery, and arbitrary command execution. CISA found that the Ivanti ICT failed to detect compromise while investigating multiple hacking incidents involving hacked Ivanti appliances. This happened because web shells that were found on systems had no file mismatches, according to Ivanti's ICT. Additionally, forensic analysis revealed that the attackers covered their tracks by overwriting files, time-stomping files, and re-mounting the runtime partition to restore the compromised appliance to a "clean state." This shows that ICT scans were not always reliable in detecting previous compromises and can create a false sense of security that the device is free of any compromise, according to CISA. Ivanti has now released an updated external Integrity Checker Tool to resolve the issues in their previous scanner. Fu...