CISA warns against using hacked Ivanti devices even after factory resets

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) revealed today that attackers who breached Ivanti appliances using one of multiple actively exploited vulnerabilities can maintain root persistence even after performing factory resets. Furthermore, they can also evade detection by Ivanti's internal and external Integrity Checker Tool (ICT) on Ivanti Connect Secure and Policy Secure gateways compromised using CVE-2023-46805, CVE-2024-21887, CVE-2024-22024, and CVE-2024-21893 exploits. The four vulnerabilities' severity ratings range from high to critical, and they can be exploited for authentication bypass, command injection, server-side-request forgery, and arbitrary command execution. CISA found that the Ivanti ICT failed to detect compromise while investigating multiple hacking incidents involving hacked Ivanti appliances. This happened because web shells that were found on systems had no file mismatches, according to Ivanti's ICT. Additionally, forensic analysis revealed that the attackers covered their tracks by overwriting files, time-stomping files, and re-mounting the runtime partition to restore the compromised appliance to a "clean state." This shows that ICT scans are not always reliable in detecting previous compromises and can create a false sense of security that the device is free of any compromise, according to CISA. Furthermore, the U.S. cybersecurity agency could independently confirm in a test lab that more than Ivanti's ICT is needed to dete...