Ivanti VPN Flaws Exploited by DSLog Backdoor and Crypto Miners

Ivanti released patches on January 31 and early February 2024 to fix multiple critical vulnerabilities in Ivanti Connect Secure and Policy Secure appliances after zero-day flaws were exploited in the wild; attackers leveraged SAML and command-injection issues to obtain root, install a DSLog backdoor that logs requests and executes commands, and deploy KrustyLoader and crypto miners, with Orange Cyberdefense identifying roughly 700 compromised appliances and advising patching, factory resets, and additional updates.