Ivanti Connect Secure 0-Days Exploited to Steal Active Directory Credentials

Attackers chained three zero-day flaws in Ivanti Connect Secure VPN appliances to gain root-level access without logging in, then searched for credentials and sensitive Active Directory data. The activity, which began on October 3, 2026, targeted a fully patched appliance running version 22.8R2.4, showing that keeping a device current did not protect it from these previously unknown flaws. Volexity found the intrusion while investigating suspicious activity at a customer and worked with Ivanti to examine the affected device. The security firm tracks the previously unknown actor as UTA0576. Its analysis found attempts to steal domain credentials, Local Administrator Password Solution (LAPS) passwords, BitLocker recovery keys, and...

Read the full article at the source.