The appliance was fully patched when they got in, and one link in the chain still is not fixed

Volexity has published an analysis of attacks on Ivanti Connect Secure by an actor it designates UTA0576, previously unknown to it. Ivanti released patches on 13 October for CVE-2026-104935, and CISA added it to the exploited catalogue the same day with a 16 October deadline.

The detail that frames everything else: Volexity began investigating on 5 October and found the appliance fully patched and running the latest available build.

Three links, two patched

The intrusion is a chain, and the identifier covers only part of it.

One — authentication bypass. Requests to a public login script could be routed to protected internal scripts using a particular HTTP header. Patched.

Two — remote code execution. A race condition in an upload handler let a script run before the handler deleted it. Patched.

Three — privilege escalation. A separate component in Ivanti Connect Secure is abused to run commands as root, and this is the link that is not patched. Volexity says Ivanti is working on a fix, to arrive in a future release.

So CVE-2026-104935 closes the front door and the hallway. The staircase is still there. That matters because a privilege escalation outlives the entry point it was paired with: any future bug that gets code running on the appliance can be chained to the same unpatched component to reach root.

Nothing to find afterwards

The post-exploitation is the part defenders should read twice, because it is built to leave nothing behind.

Volexity found no backdoor and no web shell. Commands and their output travelled over the exploit's own HTTPS requests — the same channel used to break in. There is no implant to discover, no beacon to spot, no second connection to a strange address.

The anti-forensics are thorough: selective removal of individual entries from the debug and audit logs rather than wiping them, payloads that delete themselves, in-memory patches restored after use, command output suppressed, and a renamed copy of tcpdump disguised as a system daemon.

And the vendor's own tooling does not help. Volexity states that the Integrity Checker does not detect any modifications in this case, because the chain patches memory and restores configuration data, and that the tool may not be able to identify device compromise. Its guidance is that forensic investigation is required to find evidence of exploitation.

That is a hard message for anyone running these appliances. The reassurance mechanism returns a clean result on a compromised device.

Why it is always the appliance

Edge appliances keep ending up in these stories, and the reasons are structural rather than coincidental.

They are the one device every remote user authenticates through, which makes credentials stolen there credentials for everything behind them. They run vendor-controlled operating systems that customers cannot inspect, so there is no endpoint agent watching and no familiar log to read. They are exempted from patch windows precisely because taking them down disconnects the workforce. And the diagnostic tooling a customer is given is written by the vendor, which is why the Integrity Checker result above is worth so little here.

The result is a class of device that is maximally exposed, minimally observable and slowest to update. An attacker choosing where to spend a zero-day is not picking at random.

What they took

Once at root, the activity is credential-focused and fast: LDAP credentials, LAPS passwords, BitLocker recovery keys, Active Directory attributes that carry passwords, Kerberoasting tooling, password spraying, LDAP packet capture, and exfiltration of Active Directory and configuration data.

That is not reconnaissance for a later ransomware deployment in the usual shape. It is a sweep for the keys to everything the VPN fronts.

Attribution, at Volexity's confidence

Two assessments, and Volexity is careful about both.

It assesses with low confidence that the motivation is criminal rather than espionage, based on the target.

It assesses with medium confidence that the actor uses large language models for exploit development and post-exploitation.

That second one is worth sitting with. It is the third operation this month where researchers have reported AI tooling inside an intrusion — an access broker running agents beside Cobalt Strike, the ARTEX campaign against South Korean finance, and now this. In every case the assessment is hedged, and in every case it is an inference from artefacts rather than an observation of a tool. The pattern is real and the evidence for each instance is thinner than the headlines.

What to do

• Patch now. The deadline CISA set is 16 October, and exploitation began on 3 October.
• Do not treat a clean Integrity Checker result as clearance. Volexity says plainly that it may not detect this.
• Assume credential compromise if the appliance was internet-facing before patching. Rotate LDAP service accounts, re-issue LAPS passwords, and treat BitLocker recovery keys as exposed.
• Hunt in your own network rather than only on the box. With no implant to find, the evidence is in what the stolen credentials did next.
• Watch for the privilege escalation fix and apply it when it ships. The chain is only two-thirds closed.

What is not established

• How many organisations were affected. Volexity describes its investigation, not a count.
• Who UTA0576 is. The actor was previously unknown and the motivation assessment is low confidence.
• What role language models actually played, beyond a medium-confidence assessment.
• Whether the activity observed completed successfully. Volexity notes the extent of each operation is not fully established.
• When the privilege escalation will be fixed.