Ivanti Zero-Day Operation and Attack Proxy Rotation

In October 2026, an operation suspected of being conducted by UTA0576 targeted Ivanti Connect Secure appliances using a zero-day exploit chain involving CVE-2026-111357, CVE-2026-118527, and CVE-2026-104935. Analysis of an exposed open directory on 208.85.17[.]99 revealed an extensive exploit framework, run logs for 168 targets, and a Russian-language 'memory file' for an AI coding agent that detailed the operator's infrastructure rotation.

The attack chain utilized an authentication bypass via the X-DSCGI-PATH header to upload malicious Perl scripts, followed by a local privilege escalation to gain root access. While the operation demonstrated high OPSEC intent—prescribing the use of specific VPS proxies to mask the operator's home IP—the accidental exposure of the staging server provided significant intelligence on the group's tactics, including the theft of AD credentials, LAPS passwords, and BitLocker keys.

This activity represents a critical threat to organizations using Ivanti Connect Secure, as the techniques used are known to evade standard Integrity Checker Tools. The evidence suggests a broad campaign targeting government and private sectors for data exfiltration and potential ransomware deployment.