Ivanti Vulnerability Exploited to Install 'DSLog' Backdoor on 670+ IT Infrastructures

**Ivanti SSRF (CVE-2024-21893) exploited to deploy DSLog backdoor:** Threat actors are actively exploiting a recently disclosed SSRF in Ivanti Connect/Policy Secure (CVE-2024-21893) to modify a legitimate Perl logging module (DSLog.pm) and install a persistent backdoor named DSLog that executes decoded commands as root, embeds per-appliance hashes to evade detection, and erases logs to cover tracks; Orange Cyberdefense observed compromises starting Feb 3 and detected hundreds of affected appliances (670 initially, 524 later), and vendors recommend factory resetting appliances before applying patches to remove attacker persistence.