Ivanti Connect Secure exploits deploy Cobalt Strike, vshell
JPCERT/CC observes attackers exploiting Ivanti Connect Secure CVE-2025-0282 and CVE-2025-22457 to deploy custom loaders, Cobalt Strike, vshell RAT, and Fscan network scanner since December 2024.
Sourceblogs.jpcert.or.jp — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2017-0144, CVE-2025-0282, and CVE-2025-22457 as exploited in the wild.
JPCERT/CC has identified ongoing exploitation of Ivanti Connect Secure vulnerabilities CVE-2025-0282 and CVE-2025-22457 from December 2024 through July 2025. Attackers deploy MDifyLoader, a custom loader based on libPeConv that uses RC4 decryption with keys derived from MD5 hashes of executable files, to launch Cobalt Strike Beacon version 4.5 through DLL side-loading. The loader contains extensive junk code to hinder analysis, and the Beacon itself uses custom RC4 encryption with the hardcoded key "google" for configuration data. Additional tools include vshell version 4.6.0, a Go-based multi-platform RAT with Chinese language checks, and Fscan, an open-source network scanner loaded via a FilelessRemotePE-based loader with ETW bypass capabilities.
Post-compromise activities demonstrate sophisticated tradecraft including brute-force attacks against Active Directory servers, exploitation of MS17-010 against unpatched systems, and lateral movement via RDP and SMB using stolen credentials. For persistence, attackers create domain accounts added to existing groups, register malware as services or scheduled tasks, and maintain long-term access through blended accounts. Defense evasion techniques include multi-stage loading through legitimate executables like rmic.exe, push_detect.exe, and python.exe, ETW bypass in ntdll.dll, and fileless execution to evade EDR detection.
The campaign targets VPN devices and demonstrates active, persistent exploitation with repeated deployment attempts and tool refinement. Organizations using Ivanti Connect Secure should prioritize patching these vulnerabilities and monitor for indicators associated with this ongoing threat activity.
Mentioned in this report
Detection guidance
3 detections for this report are in the app — indicator rules, each with Sigma, Splunk SPL, and Elastic, some with Microsoft Defender XDR KQL, YARA, or Suricata as well. Free account, no card.
Source reporting: https://blogs.jpcert.or.jp/en/2025/07/ivanti_cs.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs