Embed Notice

Additional IPs compromised with credential stealers injected into vulnerable Ivanti Connect Secure VPN devices now shared daily in our Compromised Website report https://shadowserver.org/what-we-do/network-reporting/compromised-website-report/

168 compromised IPs found in our scans on 2023-01-19: https://dashboard.shadowserver.org/statistics/combined/tree/?day=2024-01-19&source=compromised_website&source=compromised_website6&tag=credential-stealer%3Binjected-code%3Bivanti-connect-secure%3Bssl&geo=all&data_set=count&scale=log

Total for 2023-01-19: 550 IPs still compromised (includes GIFTEDVISITOR variant webshells) - https://dashboard.shadowserver.org/statistics/combined/time-series/?date_range=7&source=compromised_website&source=compromised_website6&tag=ivanti-connect-secure%2B&group_by=geo&style=stacked

Recovery guidance from Ivanti - https://forums.ivanti.com/s/article/Recovery-Steps-Related-to-CVE-2023-46805-and-CVE-2024-21887?language=en_US