Description: Cybersecurity threat intelligence company, GreyNoise, has reported an 800 percent increase in IP scanning on Ivanti VPN's Connect Secure and Pulse Secure systems over the past week, possibly indicating preparation for potential exploitation and public disclosure of vulnerabilities. Nearly a quarter of all scanning activity for Pulse Secure and Connect Secure endpoints recorded over the past 90 days happened in a single day, with a large proportion of IPs designated as 'suspicious' or 'malicious'. Ivanti's Connect Secure has been repeatedly targeted due to its role in enterprise remote access. The company advise customers to upgrade from end-of-life products to ensure system protection against known vulnerabilities.

Description: Ivanti, a cybersecurity firm, predicts Ransomware as a top threat for 2025, with AI enhancements escalating its danger. Despite 38% of security professionals foreseeing an increased threat level, only 29% feel very prepared, indicating a significant preparedness gap. Organizations struggle with exposure management adoption, with data blind spots and tool disparities between IT and security teams. API and software vulnerabilities remain critical threats without proper visibility. Moreover, considerable tech debt interferes with security practices, growth, and innovation, ultimately affecting the strategic role of CISOs in guiding AI adoption and supply chain risk management, despite increased board-level cybersecurity discussions.

Description: In the first quarter of 2025, Ivanti Connect Secure suffered a significant ransomware attack. Threat actors targeted the company with a zero-day exploit purchased for $200,000, resulting in unauthorized remote code execution. The attack led to sensitive data exfiltration and resulted in leak site posts threatening to disclose the information if the ransom was not paid. The attack demonstrated the financial maturity of the ransomware groups, showing their ability to reinvest in sophisticated tools to perpetrate more advanced attacks. Ivanti Connect Secure experienced substantial data compromise, reputational damage, and financial implications due to the breach. This incident underscores the urgent need for enhanced cyber defenses and proactive security measures.

Description: Ivanti suffered a security breach due to the exploitation of the vulnerability CVE-2025-0282, which affected Ivanti Connect Secure appliances. An advanced malware known as RESURGE targeted this flaw, providing unauthorized remote code execution and privilege escalation. There were a limited number of customers directly impacted by the breach. The exploitation of this vulnerability enabled the installation of persistent web shells, credential harvesting, account creation, and elevation of attacker privileges, posing a significant threat to the confidentiality, integrity, and availability of the organization's systems and data.

Description: Chinese espionage threat actors exploited a vulnerability in Ivanti's security products, leading to the deployment of powerful malware known as Resurge. This malware campaign, detailed by the Cybersecurity and Infrastructure Security Agency (CISA) and cybersecurity firm Mandiant, has resulted in compromised system integrity and data breaches. The malware's capability to modify files, harvest credentials, create accounts, reset passwords, and escalate permissions poses a significant security threat. Ivanti has advised customers to reset devices and credentials, evidencing the severity of this security breach.

Description: Ivanti experienced a severe security breach due to an unauthenticated remote code execution vulnerability, CVE-2025-22457, exploited by a China-nexus threat actor. This vulnerability, impacting Ivanti Connect Secure, Pulse Connect Secure, Ivanti Policy Secure, and ZTA Gateways, allowed attackers to execute arbitrary code remotely via a complex heap spray technique. The exploitation resulted from a failure to check buffer lengths within the application's web server binary. With patches released for some products and others pending, the incident underscores the critical importance of applying security updates promptly to avoid potential data breaches and system compromisation.

Description: Ivanti has released security updates for its Neurons for ITSM IT service management solution to mitigate a critical authentication bypass vulnerability. Tracked as CVE-2025-22462, this flaw allows unauthenticated attackers to gain administrative access to unpatched systems in low-complexity attacks. Ivanti also patched a default credentials security flaw in its Cloud Services Appliance (CSA) and a critical Connect Secure zero-day exploited by the UNC5221 China-linked espionage group. Multiple other Ivanti security flaws have been exploited in zero-day attacks over the last year.

Description: The vulnerabilities CVE-2025-4427 and CVE-2025-4428 in Ivanti Endpoint Manager Mobile (EPMM) were exploited by a Chinese cyber espionage group. The attackers achieved remote code execution on internet-exposed Ivanti EPMM deployments, set up a reverse shell, deployed malware, and extracted data including IMEI, phone numbers, location, LDAP users, and Office 365 tokens. The attack affected various entities globally, including government authorities, healthcare organizations, research institutes, legal firms, telcos, manufacturers, aerospace companies, healthcare providers, and more.