UTA0576

Previously unknown threat actor tracked by Volexity, which from 3 October 2026 exploited a zero-day chain in Ivanti Connect Secure (authentication bypass and RCE tracked as CVE-2026-104935, plus a privilege escalation) to obtain unauthenticated root code execution on a fully patched appliance (22.8R2.4). It re-ran the whole exploit chain for each command instead of deploying a web shell or backdoor, and used in-memory Python, Perl and Bash stages. Post-exploitation focused on credential theft and reconnaissance: Active Directory exports and a custom LDAP tool searching for LAPS passwords and BitLocker recovery keys, parsing of the appliance's own packet captures for LDAP, HTTP Basic and NTLM credentials, a Python Kerberos implementation, and password spraying. Anti-forensic steps included selective log tampering, restoring patched in-memory components and evading the Ivanti Integrity Checker Tool. Volexity assesses with low confidence a criminal rather than espionage motivation, and with medium confidence that the actor uses LLMs for exploit development and post-exploitation.

Recent activity

• Ivanti Connect Secure exploit chain of three vulnerabilities: unauthenticated root access 🔗 https:// cybersecurefox.com/en/ivanti-c onnect-secure-exploit-chain
  mastodon · Nov 3, 2026

References

• https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.