Search — “UTA0576”

Ivanti Connect Secure gateways were compromised via two zero-days chained with the authentication bypass CVE-2026-104935, with exploitation reported since at least October 1, 2026, per Volexity and Defused as cited by BleepingComputer. Volexity attributes the activity to UTA0576, which gained unauthenticated root-level code execution, deployed no malware or web shell, re-exploited the device for each command, and tampered with logs. Hunters should look for anomalous ICS behavior and log tampering rather than relying on a clean Integrity Checker Tool result.

Per the brief, an authentication-bypass zero-day in Ivanti Connect Secure, tracked as CVE-2026-104935, has been exploited since October 1, with honeypots logging 105 exploit attempts. The brief says the flaw was only partially patched in an earlier July fix. No source text was available, so no technical behaviors, artifacts, or indicators could be verified.