Malware Identified in Attacks Exploiting Ivanti Connect Secure Vulnerabilities

JPCERT/CC reports ongoing exploitation of Ivanti Connect Secure vulnerabilities (CVE-2025-0282, CVE-2025-22457) enabling initial access since Dec 2024; attackers deploy loaders (MDifyLoader, python311.dll) to run Cobalt Strike Beacon, vshell RAT and Fscan in-memory, use brute-force and SMB exploits for lateral movement, create domain accounts for persistence, and employ ETW/EDR evasion — the report includes malware hashes, C2 hosts and full Beacon/vshell configs.