Report: Chinese hackers breached dozens of Ivanti firms via VPN bugs - AI News Today Recency

# Report: Chinese Hackers Breached Dozens of Ivanti Firms Via VPN Bugs

Chinese state-sponsored hackers have exploited critical vulnerabilities in Ivanti's VPN products to breach dozens of organizations worldwide, according to recent reports from cybersecurity researchers and government agencies. The campaign, which targeted both current customers and users of legacy VPN appliances, demonstrates how long-running cyber espionage operations can evade detection while causing significant damage to critical infrastructure and government networks.

Chinese State-Sponsored Attack on Ivanti VPN Infrastructure

Chinese state-sponsored hackers have targeted multiple vulnerabilities in Ivanti VPN products, specifically Ivanti Connect Secure (formerly Pulse Secure) and Ivanti Policy Secure gateways[5]. The vulnerabilities—tracked as CVE-2023-46805, CVE-2024-21887, CVE-2024-21888, and CVE-2024-21893—when used together, allow unauthorized authentication bypass and remote command execution[5].

The threat actors behind this campaign have been identified as UNC6201, a suspected Chinese government-backed threat group that overlaps with UNC5221, also known as Silk Typhoon[2]. These groups have been burrowing into critical infrastructure and government agency networks undetected since at least 2022[2].

Scope of the Breaches and Affected Organizations

A backdoor planted in Pulse Secure's VPN software allowed Chinese hackers to gain access to 119 other unnamed organizations that used the company's VPN product[3]. The breach was discovered in February 2021 when Ivanti discovered that hackers had breached the network of Pulse Secure, one of its subsidiaries that provided VPN appliances to dozens of companies and government agencies around the world[3].

Mandiant was reportedly aware of the breaches, alerting Ivanti that hackers had exploited the bug to breach European and U.S. military contractors[3]. The previously unreported breach represents one of the most significant supply chain compromises affecting critical VPN infrastructure used by government and defense organizations.

Attack Methods and Lateral Movement Tactics

Once inside victim networks, the threat actors employed sophisticated techniques to maintain access and extract sensitive data. Observed activities included[5]:

- Archiving files including NTDS.dit using 7-Zip before exfiltration - Creating memory dumps of the LSASS process using Windows Task Manager - Moving laterally via remote desktop protocol (RDP) - Deleting logs to cover their tracks

The threat actors dumped configuration data containing schema, settings, names, and credentials of various users and accounts within compromised networks[5]. Unit 42 researchers believe the threat actors shifted focus to wider exploitation to maximize impact before organizations could begin patching and applying mitigation guidance[5].

Security Failures and Private Equity Impact

The breaches underscore how acquisitions and cost-cutting by private equity firms compromised the quality and security of Ivanti's critical technologies[3]. After private investment giant Clearlake Capital Group acquired Ivanti in 2017, rounds of cuts—particularly in 2022—affected employees who had deep institutional knowledge of the company's products and their security[3].

This pattern mirrors similar issues at rival remote access provider Citrix, which experienced large-scale layoffs following a 2022 deal by Elliott Investment Management and Vista Equity Partners[3]. Both companies have since been mired by cybersecurity incidents and critical flaws in recent years[3].

Ivanti's VPN products have been the cause of at least two other major attacks since the 2021 breach. In early 2024, the U.S. cybersecurity agency CISA ordered all federal agencies to disconnect their Ivanti VPN appliances within two days because hackers were actively exploiting previously unknown vulnerabilities[3]. Additionally, Ivanti warned customers that hackers were exploiting another critical flaw in its Connect Secure product to compromise corporate customers[3].

Frequently Asked Questions

What vulnerabilities did Chinese hackers exploit in Ivanti VPN products?

Chinese state-sponsored hackers exploited multiple vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways, including CVE-2023-46805, CVE-2024-21887, CVE-2024-21888, and CVE-2024-21893[5]. When used together, these vulnerabilities allow unauthorized authentication bypass and remote command execution[5].

How many organizations were affected by the Ivanti VPN breaches?

The backdoor planted in Pulse Secure's VPN software allowed hackers to gain access to at least 119 other unnamed organizations that used the company's VPN product[3]. Additionally, dozens of U.S. government and military contractor organizations were impacted by the campaign[3].

Which Chinese threat groups were responsible for the attacks?

The attacks were carried out by UNC6201, a suspected Chinese government-backed threat group that overlaps with UNC5221 (also known as Silk Typhoon)[2]. These groups have been targeting critical infrastructure and government agency networks since at least 2022[2].

What tactics did the threat actors use after gaining initial access?

After gaining initial access, threat actors performed lateral movement via RDP, dumped credentials and configuration data, created memory dumps of sensitive processes, and archived files for exfiltration using 7-Zip[5]. They also deleted logs to cover their tracks[5].

How did private equity ownership affect Ivanti's security posture?

After Clearlake Capital Group acquired Ivanti in 2017, the company underwent rounds of cost-cutting layoffs—particularly in 2022—that affected employees with deep institutional knowledge of product security[3]. This reduced security expertise contributed to the vulnerabilities and breaches that followed[3].

What patches are available for the Ivanti VPN vulnerabilities?

Ivanti has released patches for the most commonly used versions of their products affected by CVE-2023-46805, CVE-2024-21887, CVE-2024-21888, and CVE-2024-21893[5]. However, the company has not yet released patches for all vulnerable versions, leaving some organizations at heightened risk[5].