More info from Mandiant:
https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day
I'll say that Ivanti customers are lucky that the attackers aren't trying very hard here. Mandiant admits that the attackers are already attempting (poorly) to bypass the ICT. But they did such a bad job that their faked ICT results had only 3 steps instead of 10.
It's trivial to modify an ICS so that the ICT fakes the 10 steps of the ICT, without including the rickroll step of 11.
It's only safe to assume here that only the the B Team of Ivanti attackers were detected anywhere. And that anybody with a touch more skills are still in your boxes if you're only relying on the ICT as Ivanti recommends running it for detection of badness. But I suppose that's the case with just about anything... you only notice the folks that are bad enough to get caught. 🤦♂️
=> View attached media | View attached media
=> More informations about this toot | View the thread | More toots from wdormann@infosec.exchange
text/geminiThis content has been proxied by September (ba2dc).