Ivanti zero-day exploited by APT group that previously targeted Connect Secure appliances – Source: www.csoonline.com

Researchers from Google’s Mandiant division believe the critical remote code execution vulnerability patched on Wednesday by software vendor Ivanti has been exploited since mid-December by a Chinese cyberespionage group. This is the same group that has exploited zero-day vulnerabilities in Ivanti Connect Secure appliances back in January 2024 and throughout the year.

Malware prevents legitimate upgrades

In its security advisory, Ivanti directed customers to perform a factory reset on appliances before deploying the patched 22.7R2.5 version. The company did not go into details as to why but based on Mandiant’s analysis it’s because of the PHASEJAM dropper which modifies multiple legitimate Connect Secure components, including the one responsible for system upgrades. It does this in order to block and then simulate upgrades in a visually convincing way, even displaying the new version number at the end of the process.

“The first technique, utilized by PHASEJAM, prevents legitimate ICS [Ivanti Connect Secure] system upgrade attempts by administrators via rendering a fake HTML upgrade progress bar while silently blocking the legitimate upgrade process,” the Mandiant researchers explain. “Due to the blocked upgrade attempt, the technique would allow any installed backdoors or tools left by the threat actor to persist on the current running version of the VPN while giving the appearance of a successful upgrade.”

PHASEJAM also modifies legitimate files from the ICS web interface in order to inject a web shell that gives attackers remote access to the device, the ability to execute additional malicious code and to exfiltrate data from the device.

PHASEJAM comes in the form of a bash script and is deployed as a payload following the initial exploit for CVE-2025-0282 after some preparation steps that involve disabling the SELinux protections of the OS, blocking system log collection and remounting the root partition as writable so its files can be modified.

Following the exploitation, the attackers perform several steps to remove evidence of the attack including clearing kernel messages and removing entries from debug logs, deleting troubleshoot information packages and any memory core dumps generated by crashes that could be used in forensics analysis, removing application event log entries related to various failures, crashes and certificate handling errors, and clearing the SELinux audit log of executed commands.

Persistence across upgrades

In addition to blocking and simulating upgrades, the attackers deploy a mechanism to survive legitimate upgrades if they do happen. Normally the root partition is wiped during an upgrade as it’s supposed to be read-only, so the attackers hijack the execution flow of dspkginstall, a legitimate utility used during the upgrade process, in order to copy several malicious components to the temporary upgrade partition that’s mounted on /tmp/data/.

“SPAWNANT establishes an additional method of backdoor access by writing a web shell into compcheckresult.cgi on the upgrade partition,” the researchers explained. “The web shell uses system() to execute the value passed to a hard-coded query parameter.”

SPAWNANT has three components: the SPAWNMOLE tunneler (libsocks5.so), the SPAWNSNAIL SSH backdoor (libsshd.so) and the SPAWNSLOTH log tampering utility (.liblogblock.so). It also tricks the Ivanti Integrity Checker Tool (ICT) by recalculating the SHA256 hash for any files it has modified and generates a new RSA key pair to sign the modified manifest that the ICT uses for integrity checking.

Mandiant notes that there is still a way to tell successful and correct ICT reports from tampered ones due to the number of steps listed. Screenshots with the differences are provided in their analysis.

Lateral movement and credential theft

The APT group uses built-in command line tools such as nmap and dig to perform network reconnaissance and tries to perform LDAP queries using the LDAP service account or to access Active Directory servers, through SMB and RDP.

A Python script dubbed DRYHOOK modifies a system component called DSAuth.pm to intercept legitimate authentications on the appliance and log credentials. Separately, the attackers attempt to exfiltrate the appliance database which contains VPN session cookies, API keys, certificates and credential material.

“Mandiant assesses that defenders should be prepared for widespread, opportunistic exploitation, likely targeting credentials and the deployment of web shells to provide future access,” the researchers said. “Additionally, if proof-of-concept exploits for CVE-2025-0282 are created and released, Mandiant assesses it is likely additional threat actors may attempt targeting Ivanti Connect Secure appliances.”