TTP & IOC´s - Ivanti CS Exploit Chain - MDifyLoader, Cobalt Strike, vshell, Fscan, DslogdRAT

Chaitanya B B@mralien

•updated Jul 19, 2025•6•5•109

Detects activity related to exploitation of Ivanti Connect Secure vulnerabilities (CVE-2025-0282, CVE-2025-22457) using MDifyLoader, Cobalt Strike, vshell, DslogdRAT, and Fscan. Includes file, process, and network-based IOCs from JPCERT report.