Ivanti vulnerabilities provoke a surge in attacks on CISA
In recent developments, the ongoing exploitation of vulnerabilities in Ivanti Connect Secure and other remote access VPNs has served as a stark reminder of the necessity of having an incident response plan in place. This comes as the Cybersecurity and Infrastructure Security Agency (CISA) faces significant cyber threat pressure, although there is no direct publicly confirmed report of a successful cyberattack on CISA itself by August 12, 2025.
The Ivanti vulnerabilities, identified as CVE-2025-4427 and CVE-2025-4428, continue to be actively exploited by threat actors. Darktrace's investigation shows that attackers leverage these flaws primarily for exploit validation and initial payload delivery, using obfuscated command-and-control techniques like DNS requests to Out-of-Band Application Security Testing (OAST) domains and script deliveries via AWS S3 buckets. Cases linking Ivanti exploitation to further infrastructure vulnerabilities such as SAP NetWeaver exploits indicate multi-stage attack chains. This activity has been ongoing at least since mid-2025, with similar patterns observed in earlier Ivanti vulnerability exploits dating back to 2023 and 2024.
In response, CISA has been actively monitoring these threats and issuing alerts to affected parties, integrating these vulnerabilities into its known exploited vulnerabilities list. CISA also works closely with vendors like Microsoft to notify systems operators and urge immediate mitigations, as demonstrated by recent cases with Microsoft SharePoint and Citrix vulnerabilities. Additionally, CISA provides recommendations for mitigation steps, such as terminating specific active sessions and hunting for indicators of compromise, as in the case of Citrix NetScaler exploits.
However, CISA's capacity to respond may be impacted by recent federal budget cuts, which have reduced its workforce by about one-third. This resource reduction comes amid a growing cyber threat landscape, increasing the importance of private-sector vigilance and prompt patching of known vulnerabilities, including those in Ivanti products.
It is essential for organizations to be aware of these ongoing threats and take proactive measures to protect their systems. CISA urges all organizations to review their latest Ivanti advisory and take steps to protect their systems. If an incident occurs, having an incident response plan in place can help organizations mitigate the damage and recover more quickly.
References:
- CISA Alert: Active Exploitation of Ivanti Vulnerabilities
- Darktrace Investigation Reveals Ongoing Attacks Exploiting Ivanti Vulnerabilities
- CISA Urges Immediate Mitigation of Citrix NetScaler Vulnerabilities
- CISA Adds Ivanti Vulnerabilities to Known Exploited Vulnerabilities Catalog
- Federal Budget Cuts Impact CISA's Ability to Respond to Cyber Threats
- Given the ongoing active exploitation of Ivanti vulnerabilities, such as CVE-2025-4427 and CVE-2025-4428, cybersecurity in finance and technology sectors must prioritize incident response plans, following recommendations from CISA for immediate mitigations and vigilant patching.
- As threat actors continue to leverage vulnerabilities in remote access VPNs like Ivanti Connect Secure, it becomes crucial for cybersecurity teams to investigate and identify potential indicators of compromise, like obfuscated command-and-control techniques and script deliveries via AWS S3 buckets, as shown in Darktrace's investigation.
- With the growing cyber threat landscape and recent federal budget cuts affecting CISA's workforce, it is essential for organizations to strengthen their own cybersecurity posture by reviewing the latest Ivanti advisory and using best practices, including reviewing network activity for indicators of compromise, terminating active sessions, and promptly patching systems, to minimize the impact of successful cyberattacks.
