webshell Archives

Threat Intelligence

Ivanti Connect Secure VPN Exploitation: New Observations

January 18, 2024

Matthew Meltzer, Sean Koessel, and Steven Adair

On January 15, 2024, Volexity detailed widespread exploitation of Ivanti Connect Secure VPN vulnerabilities CVE-2024-21887 and CVE-2023-46805. In that blog post, Volexity detailed broader scanning and exploitation by threat actors […]

Threat Intelligence

Ivanti Connect Secure VPN Exploitation Goes Global

January 15, 2024

Cem Gurkok, Paul Rascagneres, Sean Koessel, Steven Adair, and Tom Lancaster

Important: If your organization uses Ivanti Connect Secure VPN and you have not applied the mitigation, then please do that immediately! Organizations should immediately review the results of the built-in […]

Threat Intelligence

Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN

January 10, 2024

Matthew Meltzer, Robert Jan Mora, Sean Koessel, Steven Adair, and Tom Lancaster

Volexity has uncovered active in-the-wild exploitation of two vulnerabilities allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices. An official security advisory and knowledge base article have been […]

Threat Intelligence

Mass Exploitation of (Un)authenticated Zimbra RCE: CVE-2022-27925

August 10, 2022

Volexity Threat Research

[Note: Volexity has reported all findings in this post to Zimbra. Where an existing contact was known, Volexity has notified local CERTs of compromised Zimbra instances in their constituency. The […]

Threat Intelligence

Active Exploitation of Newly Patched ColdFusion Vulnerability (CVE-2018-15961)

November 8, 2018

Volexity Threat Research

If your organization is running an Internet-facing version of ColdFusion, you may want to take a close look at your server. Volexity recently observed active exploitation of a newly patched […]