Initial Access Broker Self-Patches Zero Days as Turf Control

ANSSI observed a campaign by an intrusion set called "Houken" (likely the initial access broker UNC5174) exploiting three Ivanti Connect Secure zero-day vulnerabilities (CVE-2024-8190, CVE-2024-8963, CVE-2024-9380) to gain access to organizations across France and Southeast Asia; the operators harvested credentials, established persistence (including rootkits), sometimes performed lateral movement, and then self-patched the exploited flaws to lock out other threat actors, indicating both operational sophistication and motives to sell access.