Mirai Botnet Exploits Ivanti Connect Secure Flaws for Malicious Payload Delivery

Juniper Threat Labs observed active exploitation of two Ivanti Connect Secure flaws (CVE-2023-46805 authentication bypass and CVE-2024-21887 command injection) chained to execute arbitrary commands that download and run a shell script, which in turn retrieves the Mirai botnet binary from an actor-controlled IP (192.3.152.183). The report notes the specific API endpoints abused (including /api/v1/license/key-status/ and /api/v1/totp/user-backup-code/) and describes the payload behavior (wiping files, downloading a script, setting execution permissions, and executing it). Separately, SonicWall reported a fake explorer.exe that installs a cryptocurrency miner by dropping files into /Windows/Fonts and using a batch script to start mining.