iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Ivanti zero-day attacks compromised internet-facing Connect Secure VPN appliances with custom malware, not automatically every laptop that used the VPN. The major campaigns occurred in 2024 and 2025, used different vulnerabilities, and enabled credential theft, web shells, backdoors, and network reconnaissance. Patching is necessary, but suspected compromise may require credential rotation, investigation, and rebuilding or replacing the appliance.
The word “devices” in the original claim is technically too broad. The principal victims were Ivanti Connect Secure gateways—formerly Pulse Connect Secure—along with some Ivanti Policy Secure and Neurons for ZTA gateways affected by particular vulnerabilities. Those appliances sit at the network edge, authenticate remote users, and can see or reach sensitive internal applications.
Key takeaways
- The 2024 Ivanti campaign chained CVE-2023-46805, an authentication bypass, with CVE-2024-21887, a command-injection flaw, to compromise Connect Secure and Policy Secure gateways.
- The separate 2025 campaign exploited CVE-2025-0282, a stack-based buffer overflow that allowed unauthenticated remote code execution on vulnerable gateways.
- Investigators identified multiple attacker-specific malware families, including SPAWN, LITTLEPOT, LIGHTWIRE, WARPWIRE, ZIPLINE, THINSPOOL, and RESURGE; “custom malware” does not mean one universal virus.
- A patch closes the relevant vulnerability but does not prove that an appliance compromised before patching is clean.
- Organizations with suspected exposure should investigate the appliance, rotate credentials and secrets, hunt for lateral movement, and decide whether to patch, rebuild, or replace it.
What did the Ivanti zero-day attacks actually compromise?
The Ivanti zero-day attacks primarily compromised Ivanti VPN appliances and security gateways rather than automatically infecting every Windows or macOS computer connected through them. Connect Secure is an enterprise remote-access VPN gateway positioned at the network perimeter, so an attacker who gains control of the gateway may be able to steal authentication data, observe sessions, execute commands, and use the gateway as a path toward protected systems.
Ivanti’s 2024 advisory said the original vulnerabilities affected supported Connect Secure and Policy Secure gateways and did not affect unrelated Ivanti products. The later 2025 disclosure also covered Neurons for ZTA gateways for one of the affected vulnerabilities. Product scope and fixed-version status vary by CVE, so administrators should use the current Ivanti security advisory rather than assume that one product’s remediation applies to every Ivanti gateway.
#1 Best Overall
- Hardware Controller with Professional Network Management-Centralized management for up to 100 Omada devices including Omada access points, Omada Security Gateways and Jetstream switches.
- Premium Hardware Design-Industry-leading flexible Rackmount/Desktop design with a powerful chipset, durable metal casing, 2 fast ethernet ports and 1 USB 2.0 port for auto backup.
- Dual power selection-Support PoE (802.3af/802.3at) and micro USB for flexible installations.
- Easy Network Monitor & Maintenance-The easy-to-use dashboard makes it simple to see your real-time network status and improve network maintenance for peace of mind.
- Cloud Access with No License Fee-Enjoy cloud service with no license fee with the use of OC200. Remote Cloud access and Omada app brings centralized cloud management of the whole network from different sites—all controlled from a single interface anywhere, anytime.
Which Ivanti campaigns were involved?
There were at least two technically distinct exploitation campaigns, followed by additional malware reporting. Calling all of them “the Ivanti zero-day” hides important differences between the 2024 vulnerability chain and the 2025 buffer overflow.
| Period | Primary vulnerability or vulnerabilities | What investigators reported | Why the distinction matters |
|---|---|---|---|
| January–February 2024 | CVE-2023-46805 and CVE-2024-21887, followed by additional disclosures | Authentication bypass, command execution, web shells, credential harvesting, reconnaissance, and persistence on gateways | The two principal flaws were chained; remediation involved both vulnerability closure and compromise assessment. |
| Mid-December 2024 onward; publicly disclosed January 8, 2025 | CVE-2025-0282 | Unauthenticated remote code execution through a stack-based buffer overflow; later reporting identified ZIPLINE, THINSPOOL, and related malware | This was a different technical flaw and should not be described as the 2024 authentication-bypass chain. |
| March 28, 2025 | Analysis of a device compromised through CVE-2025-0282 | CISA analyzed files including the RESURGE malware family from a critical-infrastructure organization’s appliance | The report added forensic detail about malware recovered from a real compromised Connect Secure device. |
What happened in January 2024?
Volexity publicly detailed active exploitation on January 10, 2024, after observing targeted attacks against Ivanti Connect Secure appliances. The principal chain used CVE-2023-46805 to bypass authentication and CVE-2024-21887 to inject commands. Ivanti announced patches for the four principal vulnerabilities on January 31, 2024, with releases staged across supported version trains. Government guidance later expanded the technical and incident-response warnings.
The broader 2024 vulnerability set included CVE-2024-21888, a privilege-related flaw; CVE-2024-21893, a server-side request-forgery vulnerability; and CVE-2024-22024, a later XML-related vulnerability. The CISA and partner advisory provides the government’s incident-response findings and should be consulted for historical technical detail.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Ivanti listed historical 2024 fixed releases including Connect Secure 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2, 22.5R1.1, and 22.5R2.2, plus ZTA 22.6R1.3. Those are historical release details, not current August 2026 recommendations. Administrators should verify the current supported release and upgrade path in Ivanti’s present advisory.
What happened in January 2025?
The January 2025 campaign involved CVE-2025-0282, a stack-based buffer overflow capable of unauthenticated remote code execution. Mandiant reported exploitation beginning in mid-December 2024. Ivanti disclosed CVE-2025-0282 and CVE-2025-0283 on January 8, 2025, but the exploitation described in the available reporting concerned CVE-2025-0282; administrators should not infer that CVE-2025-0283 was exploited in the same way.
According to the NVD record for CVE-2025-0282, affected versions included Connect Secure versions before 22.7R2.5, Policy Secure versions before 22.7R1.2, and Neurons for ZTA gateway versions before 22.7R2.3, subject to Ivanti’s version guidance. CISA added CVE-2025-0282 to its Known Exploited Vulnerabilities catalog on January 8, 2025, with a January 15, 2025 federal remediation deadline.
On March 28, 2025, CISA published an analysis of three files recovered from a critical-infrastructure organization’s Ivanti Connect Secure device after exploitation of CVE-2025-0282. One file was named RESURGE and showed similarities to components of the earlier SPAWN malware ecosystem. CISA’s RESURGE malware analysis report is the primary source for that finding.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHow did attackers exploit the 2024 Ivanti vulnerabilities?
In the documented 2024 chain, the attacker first bypassed authentication with CVE-2023-46805 and then used CVE-2024-21887 to execute commands on the appliance. The reported chain could be performed remotely without a normal authenticated VPN session, which made an internet-facing gateway especially valuable to an attacker.
Rank #2
- FIDO2 Certified Passkey Authentication: Officially FIDO2 certified for secure, passwordless login on supported platforms. Use modern passkeys with hardware-backed protection. Please verify your intended service supports FIDO2 hardware keys before purchase.
- Precision Fingerprint Sensor: Built-in high-accuracy biometric fingerprint sensor ensures fast, convenient authentication while preventing unauthorized access. No PIN reuse, no shared secrets—only your fingerprint unlocks the key.
- Strong Hardware 2FA/MFA Security: Enhances account protection with physical-presence and biometric verification, helping defend against phishing, credential theft, and account takeovers.
- USB-C Wired Compatibility (No NFC): Designed for stable USB-C authentication on desktops and laptops, including Windows, macOS, and Linux systems. Ideal for users and enterprises that prefer wired-only security keys.
- Durable Aluminum Shield, Portable Design: Features the same precision aluminum protective shield for long-term durability. Compact, lightweight, battery-free, and network-free-built for everyday carry and professional environments.
- Authentication bypass: CVE-2023-46805 provided a way around the gateway’s normal authentication control.
- Command injection: CVE-2024-21887 allowed commands to be executed on the appliance after the initial access.
- Modification and deployment: Attackers altered files and installed web shells, backdoors, or other implants.
- Collection: The activity included credential and session-data theft, depending on the victim and malware deployed.
- Reconnaissance and follow-on access: Attackers examined the environment and attempted persistence or movement into the protected network.
The UK National Cyber Security Centre’s exploitation guidance describes the remote exploitation risk and the resulting need to treat a vulnerable appliance as a possible compromise point, not merely as an unpatched piece of software.
The 2025 exploitation path was different. CVE-2025-0282 was a memory-safety flaw—a stack-based buffer overflow—that could provide unauthenticated remote code execution. The 2025 flaw should therefore be named separately from the 2024 authentication-bypass and command-injection chain.
What did “custom malware” mean in the Ivanti attacks?
“Custom malware” means investigators identified attacker-specific or campaign-specific malware families designed for the Ivanti appliance environment. The term does not prove that every sample was written entirely from scratch for one victim. Reporting also described modified legitimate files, specialized implants, and components that could work together as a persistence and credential-theft ecosystem.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Reported capabilities included passive backdoors that waited for specially crafted traffic, web shells for command execution, credential harvesters, droppers and launchers, trojanized legitimate files, persistence mechanisms, and anti-forensic behavior such as log manipulation or concealment. Mandiant reported that UNC5221 sometimes trojanized legitimate Connect Secure files with malicious code in the 2024 campaign.
| Malware or family | Reported role | Important qualification |
|---|---|---|
| SPAWN ecosystem | Persistence and backdoor components associated with Ivanti exploitation | SPAWN describes an ecosystem, not one single executable. |
| LITTLEPOT | Passive backdoor behavior reported in the 2024 campaign | Presence varied by victim and intrusion. |
| LIGHTWIRE | Web-shell or backdoor component used for access and command execution | Exact naming and function can vary across reporting. |
| WARPWIRE | Credential-harvesting malware | Do not assume that every compromised appliance contained WARPWIRE. |
| BUSHWALK | Web-shell variant identified in exploitation reporting | Use the terminology and technical context in the relevant investigator report. |
| ZIPLINE | Passive backdoor reported in the 2025 campaign | Associated with later CVE-2025-0282 activity. |
| THINSPOOL | Dropper reported by Mandiant | Helped deploy or support other components. |
| RESURGE | Malware analyzed by CISA in 2025 | CISA recovered and analyzed it from a compromised Connect Secure appliance. |
For the 2024 malware ecosystem, the Mandiant and Google Cloud threat-intelligence analysis is the main source for the named families and UNC5221 tracking. For the 2025 set, consult Google Cloud’s CVE-2025-0282 malware reporting and CISA’s RESURGE report.
Why were Ivanti VPN appliances high-value targets?
Ivanti gateways are high-value targets because they combine internet exposure, authentication functions, privileged appliance access, and a position between remote users and internal applications. A compromised gateway may reveal usernames, passwords, session information, certificates, configuration data, or patterns of access to internal services.
Edge appliances can also be harder to monitor than ordinary servers. An organization may have endpoint detection on employee laptops and servers but limited equivalent visibility inside a proprietary VPN appliance. That makes file modification, hidden web shells, passive backdoors, and log tampering particularly serious. The appliance should be treated as a possible launch point into the internal network, not as an isolated box.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsIs patching enough after a suspected Ivanti compromise?
Patching is essential, but patching alone is not proof of eradication. A patch prevents exploitation of the relevant vulnerability; it does not necessarily remove a web shell, restore modified files, invalidate stolen credentials, or reveal activity that occurred before the patch.
Rank #3
- 【Compatible with 30+ VPN service providers】Pre-installed with OpenVPN and WireGuard. OpenVPN speeds up to 150 Mbps; WireGuard speeds up to 355 Mbps. ***NO Wi-Fi function***
- 【Full Protection for Your Network】 Cloudflare encryption supported to protect the privacy. IPv6 security protocol supported. (To enable IPv6 function, please access to Admin Panel -> NETWORK -> IPv6.)
- 【Support VPN Cascading】Allow VPN server and VPN client operate simultaneously within the same device, enabling user to access local network servers with accessing public internet as a VPN client in the meantime.
- 【Ideal Gateway for Hosting a VPN Server at Home or Office】Access sensitive information stored under a corporate private network or access local files and bypass geo-blocking securely while working remotely.
- 【Advanced Hardware Specification】Equipped with 2.5 gigabit WAN port, 1 gigabit LAN port with USB 3.0 port, as well as 8 GByte EMMC (embedded multimedia card) storage for offline data storage.
CISA reported that compromise was not always detected by Ivanti’s Integrity Checker Tool or previous external checks. CISA also reported laboratory findings suggesting that an attacker might retain root-level persistence despite a factory reset. Ivanti disputed or qualified part of that interpretation, stating that some reported persistence behavior would cause a real appliance to lose its connection and that Ivanti had no evidence of successful threat-actor persistence after updates or factory resets in the cases it assessed. The disagreement is documented in Ivanti’s remediation FAQs.
The practical conclusion is not that every factory reset fails or that every reset succeeds. Reset effectiveness is disputed and situation-dependent. A clean Integrity Checker result is useful evidence, but it is not a complete forensic conclusion: Ivanti described the tool as a snapshot that may not detect an attacker who has returned the appliance to a clean state, removed malware, or modified the indicators the tool checks.
Should an organization patch, rebuild, or replace an Ivanti appliance?
The right action depends on exposure, evidence, supported status, and the organization’s ability to establish a trustworthy clean baseline. The following matrix is a decision aid, not a substitute for the current vendor advisory or an incident-response investigation.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Situation | More defensible response | Reason |
|---|---|---|
| No evidence of compromise; supported fixed release; useful logs and telemetry available | Apply the current fixed release, validate integrity, rotate relevant secrets, and monitor | The organization can combine vulnerability remediation with a reasonable integrity assessment. |
| Internet-exposed during active exploitation, but no clear forensic evidence | Contain, investigate, rotate credentials, and consider rebuilding | Absence of evidence may reflect limited appliance visibility rather than absence of intrusion. |
| Integrity Checker alert, unexpected file or startup changes, suspicious accounts, or anomalous authentication | Preserve evidence and rebuild or replace after incident-response planning | The appliance’s integrity cannot be assumed. |
| Privileged credentials, certificates, or sensitive sessions handled by the gateway | Assume related secrets may be exposed and perform broad rotation | Compromise impact extends beyond the appliance administrator password. |
| Unsupported appliance or no reliable clean baseline | Replace or rebuild onto a supported, validated platform | Unsupported software and uncertain integrity create continuing operational risk. |
Do not present a historical fixed release from January 2024 as current guidance in August 2026. Confirm the supported product, version, mitigation, and upgrade procedure directly with Ivanti before making a production change.
What should administrators do if an Ivanti gateway may be compromised?
Organizations should separate emergency containment from full incident response. A practical sequence is:
- Inventory the exposure. Identify every Connect Secure, Policy Secure, and Neurons for ZTA gateway, its exact version, internet-facing address, exposure window, and role in authentication.
- Follow current vendor and government guidance. Use the current Ivanti advisory and CISA guidance instead of relying on an old workaround, cached article, or unverified shell command.
- Run the Integrity Checker Tool. Record the result and preserve relevant output, but treat a clean result as evidence rather than a guarantee.
- Contain carefully. Restrict exposure or remove a suspect gateway from service where operationally possible, while preserving forensic evidence before destructive remediation.
- Assume gateway-handled secrets may be exposed. Prioritize administrator accounts, VPN credentials, service accounts, certificates, API keys, tokens, and accounts that authenticated through the appliance.
- Review telemetry. Examine authentication, VPN, web, system, and network logs for suspicious source addresses, unusual logins, new accounts, configuration changes, web-shell behavior, and access to internal systems.
- Hunt beyond the appliance. Look for lateral movement, stolen credentials used against servers, unusual administrative activity, and persistence on systems reachable from the VPN.
- Apply the fixed release or rebuild. If integrity cannot be established, rebuilding or replacing the appliance is more defensible than treating patch installation as eradication.
- Meet reporting obligations. Notify regulators, customers, insurers, law enforcement, or sector authorities when contractual, legal, or regulatory requirements apply.
Do not publish or execute generic destructive appliance commands from an old incident report. Ivanti and CISA instructions can change by product and release, and an incident responder may need to preserve evidence before reset or replacement.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Should organizations replace Ivanti remote access with zero-trust access?
Replacing a remote-access platform can reduce dependence on an appliance-based VPN architecture, but migration does not remediate a previous breach. The organization should first contain the suspected compromise, rotate exposed secrets, investigate internal systems, and establish a clean access path. Platform selection is a separate architecture and procurement decision.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →| Option | Why organizations consider it | Potential poor fit |
|---|---|---|
| Ivanti Neurons for Zero Trust Access | Provides an existing Ivanti customer with a possible migration path within the same vendor ecosystem. | Organizations that no longer trust the vendor’s gateway architecture or want independent assurance may prefer another platform. |
| Cloudflare Access | Identity-aware application access can reduce reliance on broad traditional VPN exposure. | Complex legacy-network access, private routing, specialized clients, or untested on-premises integration may require additional design. |
| Tailscale | WireGuard-based mesh networking with identity and access controls can appeal to smaller technical teams and developer environments. | It may not satisfy every large regulated enterprise’s control-plane, compliance, or traditional branch-firewall requirements. |
| Zscaler Private Access | Offers enterprise zero-trust private-application access as an alternative to broad network-level VPN access. | It may be excessive for a simple, low-cost VPN replacement or for organizations without mature identity and application-policy processes. |
| Palo Alto Networks Prisma Access | Can suit organizations already using Palo Alto Networks products and evaluating a broader SASE/SSE platform. | Licensing and deployment complexity may outweigh the benefit for an organization seeking only a narrow remote-access replacement. |
Pricing and plan limits for these services can change and were not independently verified for this article. Treat enterprise products as quote-based unless the vendor’s current page states otherwise, and test legacy applications, identity integrations, routing, client behavior, logging, and administrative workflows before committing to a migration.
Rank #4
- FIDO2/Passkey Authentication – Secure, passwordless login with supported platforms. Check if your intended service supports hardware keys before purchase. Works with Gmail, Facebook, GitHub, Dropbox, and more.
- Enhanced Multi-Factor Authentication (MFA): Strengthen account security using either FIDO2.0 authentication or TOTP/HOTP codes, providing flexible options for added protection.
- Universal Connectivity: Features USB-A and NFC compatibility, making it easy to use across various devices including PCs, Macs, iPhones, and Android phones for seamless integration.
- Durable & Portable Design: Built with a 360° rotating metal cover for extra durability. Compact and lightweight, it easily attaches to a keychain for on-the-go convenience. No batteries or network required, ensuring dependable use anywhere.
- FIDO Certified & Business-Ready: Certified for FIDO standards and supported by a range of management software suites, ideal for both individual users and enterprise deployment.
What does the incident teach about edge-device security?
The Ivanti campaigns demonstrate why perimeter appliances require the same incident-response seriousness as servers. Edge devices often have broad network reach, privileged operating-system access, authentication data, and less endpoint telemetry than conventional computers. A successful exploit can therefore create risk even when employee laptops show no malware.
Security programs should maintain an inventory of internet-facing appliances, track supported versions, monitor vendor advisories, retain authentication and network telemetry outside the appliance, rehearse emergency access changes, and define in advance when a suspect device must be rebuilt or replaced. The most important operational distinction is between fixing a vulnerability and proving that an already-compromised system is trustworthy.
Frequently Asked Questions
Were Windows or macOS laptops automatically infected by the Ivanti attacks?
No. The documented attacks primarily compromised Ivanti VPN appliances and gateways, not every laptop that connected through them. A compromised gateway could nevertheless expose credentials, sessions, or internal applications and could support follow-on attacks against systems inside the network.
Does applying an Ivanti patch remove custom malware?
No. Applying a fixed release closes the relevant vulnerability, but patching does not by itself prove that a previously compromised appliance is clean or that stolen credentials, certificates, tokens, and session data are safe. Suspected compromise requires investigation and secret rotation.
Is an Ivanti factory reset enough to remove an attacker?
Not necessarily. CISA reported laboratory findings involving possible root-level persistence after a factory reset, while Ivanti disputed or qualified how those findings applied to real-world remote exploitation. Reset effectiveness is situation-dependent, so organizations should follow current guidance and rebuild or replace the appliance when integrity cannot be established.
Should an organization change only the Ivanti administrator password?
No. If the gateway may have been compromised, the organization should assess and rotate administrator credentials, VPN credentials, service-account secrets, certificates, API keys, tokens, and other credentials or sessions handled by the appliance. The exact scope should be determined with incident responders and identity owners.
Which CVE applied to the 2025 Ivanti campaign?
The 2025 campaign publicly described in the dossier exploited CVE-2025-0282, a stack-based buffer overflow capable of unauthenticated remote code execution. CVE-2025-0283 was disclosed separately, and its exploitation status should not be inferred from CVE-2025-0282 reporting.
The Bottom Line
The accurate version of the headline is that attackers compromised Ivanti VPN appliances with multiple families of custom or attacker-specific malware. The 2024 authentication-bypass and command-injection campaign and the 2025 CVE-2025-0282 campaign were separate episodes. For a potentially exposed organization, patching is only one step: investigate, rotate affected secrets, hunt for lateral movement, and rebuild or replace the gateway when its integrity cannot be established.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
