At a glance.
- Ivanti Connect Secure zero-days exploited.
- SonicWall firewall vulnerabilities.
- Phemedrone Stealer campaign exploits Windows Defender SmartScreen vulnerability.
- GitLab patches password reset flaw.
Ivanti Connect Secure zero-days exploited.
Two recently disclosed zero-days affecting Ivanti Connect Secure VPNs are now undergoing widespread exploitation, according to researchers at Volexity. The vulnerabilities were initially being exploited in limited attacks by the suspected Chinese threat actor UTA0178. Volexity says additional actors now have access to the exploit, and have compromised more than 1,700 devices around the world. The targeting appears to be indiscriminate: “Victims are globally distributed and vary greatly in size, from small businesses to some of the largest organizations in the world, including multiple Fortune 500 companies across multiple industry verticals.”
BleepingComputer notes that more than 16,800 Connect Secure appliances are currently exposed to the internet. Volexity urges organizations to apply the mitigation provided by Ivanti until patches are available.