🚀 Medial Secures Investment on Shark Tank India - Fueling the Future of Professional Social Networking. 🔥

Startup Showcase

Premium Content

Try our Valuation Calculator →

News on Medial

Ivanti VPN security flaws are being attacked again by Chinese hackers

Techradar

Techradar · 1y ago

Ivanti VPN security flaws are being attacked again by Chinese hackers

Chinese hackers are reportedly utilizing the recently discovered security flaws in Ivanti VPN to deploy malware. The hackers, known as UNC5325, are employing living-off-the-land techniques to avoid detection while dropping novel malware. This malware can withstand factory resets, system upgrades, and patches. Another threat actor, UNC3886, may also be taking advantage of the vulnerabilities. Users are advised to take immediate action, apply the latest security advisory from Ivanti, and use external integrity checkers and updated hardening guides. The flaws were initially reported in January 2024, and subsequent investigation revealed the use of an unsupported operating system by Ivanti.

Related News

Ivanti patches two zero-days under attack, but finds another

TechCrunch · 1y ago

Ivanti patches two zero-days under attack, but finds another

Ivanti has warned that hackers are targeting its Connect Secure VPN appliance using previously undisclosed zero-day vulnerabilities. The Chinese state-backed hackers have been exploiting flaws in the VPN product since December, with the company now discovering two additional vulnerabilities. One of the vulnerabilities is described as a privilege escalation vulnerability, while the other, a zero-day bug, allows unauthorized access to restricted resources. Ivanti has observed targeted exploitation of the server-side bug and expects an increase in exploitation once details are made public. The patch to protect against these vulnerabilities has been released.

NSA says it's tracking Ivanti cyberattacks as hackers hit US defense sector

TechCrunch · 1y ago

NSA says it's tracking Ivanti cyberattacks as hackers hit US defense sector

The U.S. National Security Agency (NSA) has confirmed that hackers targeting vulnerabilities in Ivanti's VPN software have attacked organizations in the U.S. defense sector. The China-backed hacking group UNC5325 has launched massive attempts to exploit vulnerabilities in Ivanti Connect Secure, a widely used enterprise VPN appliance. The hackers demonstrate extensive knowledge of the software and have deployed malware to maintain persistence even after system updates and patches. The NSA is collaborating with other agencies to detect and mitigate the attacks. It is currently unclear how many Ivanti customers have been affected.

US defense sector under under attack China-backed hackers, with NSA confirming Ivanti exploits are to blame

Techradar

Techradar · 1y ago

US defense sector under under attack China-backed hackers, with NSA confirming Ivanti exploits are to blame

The US National Security Agency (NSA) has confirmed that the Ivanti enterprise VPN application is being exploited by hackers to target the US defense sector. The attacks are believed to be carried out by China-backed groups, posing a significant concern for the US military. The group responsible, named UNC5325, is actively exploiting Ivanti Connect Secure software and has already infiltrated thousands of organizations globally. The group uses sophisticated techniques and is capable of remaining undetected even after a factory reset. It is estimated that they are performing around 250,000 attacks per day.

Ivanti Pulse Secure was using decade-old Linux and outdated libraries — no wonder it was such a popular target for hackers

Techradar

Techradar · 1y ago

Ivanti Pulse Secure was using decade-old Linux and outdated libraries — no wonder it was such a popular target for hackers

According to security analysts, Ivanti Pulse Secure was using an outdated version of Linux (CentOS 6.4) and vulnerable libraries, making it an attractive target for hackers. Eclypsium found 973 flaws, with 111 having publicly-known exploits. Additionally, researchers discovered thousands of vulnerabilities in shell scripts, Python files, and outdated certificates. The Integrity Checker Tool (ITC) was also found to have a logic issue, allowing hackers to evade detection. Thousands of Ivanti servers remain vulnerable to these flaws, which have been exploited in state-sponsored espionage campaigns.

As if 2 Ivanti vulnerabilities under exploit weren’t bad enough, now there are 3

Arstechnica

Arstechnica · 1y ago

As if 2 Ivanti vulnerabilities under exploit weren’t bad enough, now there are 3

Mass exploitation of a critical vulnerability in Ivanti's VPN software has begun, as hackers target multiple vulnerabilities in the product. The latest vulnerability, tracked as CVE-2024-21893, is a server-side request forgery. It was discovered alongside another vulnerability that has yet to be exploited. Last week, Ivanti announced that CVE-2024-21893 was under active exploitation, intensifying an already chaotic situation. All vulnerabilities affect Connect Secure and Policy Secure VPN products. The Cybersecurity and Infrastructure Security Agency has ordered all federal agencies to disconnect Ivanti VPNs until they are rebuilt and updated.

Ongoing attacks on Ivanti VPNs install a ton of sneaky, well-written malware

Arstechnica

Arstechnica · 6m ago

Ongoing attacks on Ivanti VPNs install a ton of sneaky, well-written malware

Ivanti VPN networks are under attack due to a critical vulnerability, CVE-2025-0283, allowing hackers full control over devices. Exploited on Ivanti’s Connect Secure VPN and other gateways, this vulnerability facilitates malware installation, including DRYHOOK and PHASEJAM. PHASEJAM deceives administrators with convincing fake upgrade processes. Malware like SPAWNANT disables security checks and persists through upgrades, aiming to collect sensitive data. These attacks are attributed to China-based espionage groups UNC5337 and UNC5221.

This popular WordPress site builder has a serious security issue — and hackers are already taking advantage

Techradar

Techradar · 1y ago

This popular WordPress site builder has a serious security issue — and hackers are already taking advantage

A critical vulnerability has been discovered in the Brick Builder Theme, a popular WordPress theme with 25,000 active installations. The vulnerability allows for remote code execution, putting websites at risk of being attacked by hackers. The issue has since been patched, but hackers have already started targeting vulnerable sites to disable security plugins. Users are urged to update their theme to version 1.9.6.1 as soon as possible to avoid exploitation. WordPress, being a popular website builder, is frequently targeted by hackers, making it crucial for users to regularly update their plugins for optimal security.

The ConnectWise cyberattack just got a whole lot worse

Techradar

Techradar · 1y ago

The ConnectWise cyberattack just got a whole lot worse

ConnectWise has suffered a cyberattack with hackers exploiting recently identified flaws in the company's ScreenConnect product. Two critical vulnerabilities were patched, but security companies have now confirmed that the flaws are being exploited at scale. The bugs could be used to drop malware on vulnerable ScreenConnect instances and steal sensitive data. Major ransomware gang LockBit is among those exploiting the flaws. ConnectWise has urged its on-premise partners to take immediate action to address the security risks. It has been estimated that more than one million small and medium-sized businesses using ConnectWise were potentially affected.

Hackers are exploiting ConnectWise flaws to deploy LockBit ransomware, security experts warn | TechCrunch

TechCrunch · 1y ago

Hackers are exploiting ConnectWise flaws to deploy LockBit ransomware, security experts warn | TechCrunch

Security experts are warning that hackers are taking advantage of vulnerabilities in the widely used remote access tool ConnectWise ScreenConnect to deploy the LockBit ransomware. Two high-risk flaws in the tool, including an authentication bypass vulnerability and a path traversal vulnerability, are being actively exploited by hackers. Despite recent law enforcement action against the LockBit gang, it appears that some affiliates are still able to operate. The exact number of affected users is unknown, but the Shadowserver Foundation has reported widespread exploitation of the vulnerabilities, with over 8,200 servers remaining vulnerable.

Ivanti CEO pledges to “fundamentally transform” its hard-hit security model

Arstechnica

Arstechnica · 1y ago

Ivanti CEO pledges to “fundamentally transform” its hard-hit security model

Remote-access company Ivanti has pledged a "new era" of security and investment following severe exploits on its products in recent months. CEO Jeff Abbott promises to revamp core engineering and vulnerability management, make products secure by design, and strengthen collaborations with cyber-defense agencies. Ivanti plans to improve its search abilities and introduce an AI-powered Interactive Voice Response system for customer alerts. The company's VPN products have been targeted by threat actors, leading to a flurry of vulnerabilities. The ambitious plans outlined in the open letter aim to address these issues and enhance security practices.

Trackers

Active Indian VC’s

OG Capital Email

With a hands-on approach, OG Capital aims to invest in over 20 promising...

Accel Partners Email

Early and growth-stage investments in disruptive technology companies with...

Early-stage venture capital firm investing in technology startups in India. Focus on...

Access All Trackers

Startup Showcase Winners

June 2025

Helping your parents when you are miles away

The Pit Stop Your Cravings Deserve

The next generation E-commerce platform

Enter Ongoing Startup Showcase

Top Users

Trending News on Medial

Meta acquires voice startup Play ...

Exclusive: Porter turns profitabl ...

Zomato CEO Deepinder Goyal buys l ...

Download the medial app to read full posts, comements and news.