UTA0576 targeted Active Directory secrets that the Ivanti patch does not reset

Volexity found no backdoor and no web shell on the compromised appliance, and no first-stage malware that would let the actor run commands without exploiting the box again ^[6]. UTA0576 re-executed the entire exploit chain for each command and read the result out of the HTTP response ^[6].

Ivanti's spokesperson said the company has "fully addressed the unauthenticated remote code execution component of that chain, eliminating the primary exploitation path" ^[30]. On Volexity's evidence, that path was the only way the actor was seen running commands on the appliance ^[6]. In our view the patch ends that entry and leaves everything already copied where it is. The Hacker News noted that neither Volexity's report nor Ivanti's post says whether upgrading removes access an attacker has already gained ^[23].

What UTA0576 went after

Volexity said that "immediately after exploiting an ICS VPN appliance, UTA0576 began conducting reconnaissance, stealing credentials, and exfiltrating data" ^[10]. The credential theft came from several places at once.

The appliance held domain credentials, including LDAP credentials, and the actor stole them ^[11]. Using the appliance's own service account, a custom Python LDAP tool authenticated to an internal domain controller and searched Active Directory for LAPS local administrator passwords, BitLocker recovery keys, and any attribute holding a plaintext password ^[12]. Results were compressed, encoded and sent back through the same exploit channel ^[12]. A packet capture tool harvested cleartext credentials from LDAP traffic already passing through the device ^[13]. The actor also built a custom Kerberos implementation capable of Kerberoasting and ran password-spraying campaigns against Active Directory accounts ^[13]. SecurityWeek added that the actor parsed authentication logs to identify valid usernames and collected the appliance's configuration data ^[14].

The accounts differ on how much of the LAPS and BitLocker step succeeded. Help Net Security lists the collection of local admin passwords and BitLocker recovery keys among what the chain allowed ^[16]. Security Affairs describes a search whose results were exfiltrated ^[12].

Volexity could not establish what the actor wanted. Because the operation was detected and disrupted, it said, the ultimate objectives could not be determined ^[17]. It assessed with high confidence that the actions "signaled preparation for lateral movement and a broader compromise of the victim network" ^[17], and with low confidence that the motive is criminal ^[18]. The high-confidence call is the one that bears on a response, because lateral movement takes place inside the victim network, using whatever the actor gathered.

Why the appliance cannot clear itself

Ivanti publishes an Integrity Checker Tool to identify unexpected file modifications on disk ^[7]. Against this chain it finds nothing. The exploit patches library code in memory only and restores configuration store data, so the tool does not detect any modifications, according to Volexity ^[7].

The chain runs in sequence. The first step abuses welcome.cgi: the system checks the URL to decide whether to allow a request but reads an HTTP header to decide where to send it, and the mismatch bypasses authentication ^[8]. The second uploads a Perl script disguised as a ZIP file. The server schedules the file for deletion when validation fails, and a request that reaches the file before deletion executes it ^[8]. The third escalates from the limited web server user to root. A background service called dsinvoked runs maintenance tasks as root and looks up which programs to execute in a shared configuration store. UTA0576 patched that store in memory, redirected a legitimate task to the Perl interpreter, triggered it, and restored the original state ^[9].

The cleanup went further. UTA0576 deleted evidence of exploitation from Ivanti debug logs and Linux audit logs ^[5]. It ran a packet capture tool under a renamed executable in a directory that normal file listings do not show, with eight rotating capture files that let older traffic be overwritten ^[15]. CISA reached the same conclusion about the checker. Its alert says organizations will need to conduct network and memory forensics, and that the tool "may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory" ^[20].

What there is to look for comes from one victim. The Hacker News lists the indicators Volexity took from the incident it investigated: requests to /dana-na/auth/url_default/welcome.cgi in large numbers, an X-DSCGI-PATH header whose value does not match the URL path, the directory /data/.icscap/, and the IP 108.165.147[.]64 ^[35].

We think an appliance that ran a vulnerable build cannot be cleared by its own checker or its own logs. The credential question has to be settled without waiting for a forensic answer.

The window and the dates

Help Net Security reported that CISA ordered US federal civilian agencies to address the flaw and perform forensic triage by October 16, 2026 ^[21]. CISA had added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on October 13 ^[22], three days earlier ^[39].

Volexity dates exploitation of the appliance it investigated from October 3 ^[2]. Ivanti shipped patches on October 13 ^[3], ten days later ^[38]. Sean Koessel, vice president of professional services at Volexity, said the earliest confirmed instance of exploitation was October 1, according to CyberScoop ^[26]. From that date to the patches is twelve days ^[40]. He added that "it wouldn't surprise us if there was activity toward the end of September" ^[27].

The scale is not public. Ivanti's advisory said a limited number of customers were compromised before disclosure and that the full scope remains under investigation, CyberScoop reported ^[25]. Volexity found the activity while investigating an incident at one of its customers ^[37]. Neither company said how many customers were attacked ^[24].

Ivanti's side of the timeline starts earlier. The company said it found part of the vulnerability in June ^[36] and patched it in the July release 25.1.3.0. In its statement it said: "We had been working to backport the fix to the remaining supported versions when exploitation occurred" ^[28]. A spokesperson wrote to CyberScoop: "Because the issue was discovered internally, was not being actively exploited, and did not meet the threshold for an out-of-band release, a fix was scheduled for inclusion in our normal product release cycle" ^[29]. The victim ran 22.8R2.4 ^[1]. The fixed builds are 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1 ^[4].

One of the three flaws is still open. The privilege escalation has no patch, and Ivanti plans one over the coming weeks ^[4]. In the observed chain it ran after the first two flaws had delivered code execution as the web server user ^[9]. The Hacker News noted that Volexity's report did not disclose what risk the flaw carries on an appliance where the first two are fixed ^[31].

Repeat target, one victim

CyberScoop reported that CISA has flagged 36 Ivanti defects in its Known Exploited Vulnerabilities catalog since late 2021, and that at least six across Ivanti products have been exploited since late January ^[32]. Koessel said: "Edge devices are a valuable initial foothold and often enable attackers to pivot further into targeted networks." He added: "It would be fair to expect widespread exploitation, this is a common theme with most vulnerabilities in edge devices" ^[33]. Yordan Ganchev, principal threat intelligence specialist at watchTowr, said "widespread, indiscriminate exploitation is inevitable as attackers begin reviewing patches and public information," citing "the trivial nature of the authentication bypass" ^[34].

So far, the reports describe limited exploitation ^[25].

Volexity describes UTA0576 as an unknown threat actor ^[1]. Its tooling includes a custom Python LDAP tool ^[12], a custom Kerberos implementation ^[13] and a chain that worked against a fully patched build ^[1]. Volexity investigated one customer's incident ^[37].

What the recovery list covers

CISA recommends these steps for a suspected compromise, drawn from Ivanti's Connect Secure recovery procedures: back up the appliance configuration, factory reset and upgrade the appliance, rebuild cloud and virtual instances, and restore the configuration from the backup ^[19]. The final step reaches past the appliance. It calls for resetting passwords for all accounts, including domain, administrator and local accounts, revoking and reissuing stored certificates, and resetting stored API keys and license server credentials ^[19].

Set against Volexity's account, that step covers the domain credentials the appliance stored ^[11], the service account the LDAP tool used ^[12] and local administrator passwords ^[12]. The list does not mention BitLocker recovery keys, which Security Affairs and Help Net Security both name among the targets ^[12][16].