CISA says crooks used Ivanti bugs to snoop around high-risk chemical facilities

CISA reported that attackers exploited critical Ivanti Connect Secure/Policy Secure vulnerabilities to install an advanced webshell on the CSAT appliance, accessing the device multiple times in January; while there is no evidence of data exfiltration beyond the Ivanti device and sensitive data was encrypted, potentially exposed items included Top-Screen survey data, security assessments, encrypted site security plans, Personnel Surety Program records, and CSAT user account details. CISA recommended patching the affected Ivanti products, rotating passwords, and is arranging identity protection for individuals vetted under the Personnel Surety Program.