Chinese Hackers Exploit Zero-Day Flaws in Ivanti Connect Secure and Policy Secure

Volexity and Ivanti reported that two zero-day vulnerabilities in Ivanti Connect Secure and Policy Secure (CVE-2023-46805 and CVE-2024-21887) were chained and exploited in the wild by a suspected China-linked actor (UTA0178) to gain unauthenticated command execution, steal credentials, modify appliance files (including compcheck.cgi), deploy a GLASSTOKEN web shell for persistence, and pivot to internal networks; CISA added the vulnerabilities to its KEV catalog and Ivanti advised mitigations pending patches.