CasesS=1:500S=1:100
CISA breach via Ivanti Connect Secure: the CSAT intrusion
Days after CISA issued an emergency directive on Ivanti Connect Secure exploitation, an attacker installed a webshell on CISA's own Ivanti Connect Secure appliance.
1 Summary
On January 19, 2024, CISA issued an emergency directive on widespread exploitation of Ivanti Connect Secure. Between January 23 and 26 an attacker installed a webshell on the Ivanti Connect Secure appliance of CISA's own chemical-security assessment tool. CISA took two systems offline. It found no evidence that data was taken.
Probable cause: Days after CISA issued an emergency directive on Ivanti Connect Secure exploitation, an attacker installed a webshell on CISA's own Ivanti Connect Secure appliance.
Source: CISA Chemical Security Assessment Tool (CSAT) Ivanti Notification
The device was CISA's own Ivanti Connect Secure appliance. CISA did not say which CVE was used against it; the CVEs shown are the ones its Emergency Directive 24-01 covered.
S=1:100 2 Factual information
2.1 The way in
CISA: from January 23 to 26, 2024, "a malicious actor installed an advanced webshell on the Ivanti device" of CSAT.
Source: CISA Chemical Security Assessment Tool (CSAT) Ivanti Notification
- Product
- Ivanti Connect Secure
- CVE
- CVE-2023-46805, CVE-2024-21887
2.2 After entry
This type of webshell can run commands and write files. CISA said survey and assessment data in CSAT and CSAT user accounts may have been accessed without authorization, but found no evidence of exfiltration.
2.3 Damage
Two systems were taken offline. The incident met the federal threshold for a major incident.
2.4 Sequence of events
| Time | Actor | Event | Source |
|---|---|---|---|
| 2024-01-19 | CISA | Emergency Directive 24-01 on Ivanti Connect Secure and Policy Secure. | CISA |
| 2024-01-23 | Intruder | From January 23 to 26, a webshell is installed on CISA's Ivanti appliance. | CISA |
| 2024-01-26 | CISA | Identifies potentially malicious activity affecting the CSAT Ivanti Connect Secure appliance. | CISA |
| 2024-03 | CISA | Confirms the intrusion to the press; two systems were taken offline. | Cybersecurity Dive |
S=1:100 3 Analysis
| Point | Finding | Source |
|---|---|---|
| A webshell was installed on the Ivanti appliance between January 23 and 26, 2024. | Stated | CISA |
| The impact was limited to two systems, which were taken offline. | Stated | Cybersecurity Dive |
| Which vulnerability was used against CISA's appliance, and who the actor was. | Unknown | Cybersecurity Dive |
S=1:100 4 Conclusions
CISA states that an attacker installed a webshell on its Ivanti Connect Secure appliance during the Ivanti exploitation campaign that its own emergency directive addressed. It has not named the CVE or the actor.
S=1:100 5 Recommendations
Recommended or carried out by: CISA Emergency Directive 24-01
- Apply the vendor's mitigations to Ivanti Connect Secure and Policy Secure at once.
- Disconnect every affected instance, then factory-reset it before putting it back.
Source: CISA ED 24-01: Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities (Supplemental Direction V2)
Sources
Source: CISA Chemical Security Assessment Tool (CSAT) Ivanti NotificationCISA ED 24-01: Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities (Supplemental Direction V2)Cybersecurity Dive CISA attacked in Ivanti vulnerabilities exploit rush