SecuriTricks - CVE-2024-21887

Iran-based Cyber Actors Enabling Ransomware Attacks on US Organizations

This advisory outlines the activities of an Iran-based cyber threat group that has conducted numerous intrusions against organizations in the United States and other countries since 2017, with the goal of obtaining network access to facilitate ransomware attacks. The group, known by various names s…

ransomware

state-sponsored

Published: August 28, 2024

Downloadable IOCs: 33

Technical Deep Dive: Understanding the Anatomy of a Cyber Intrusion

This report details a sophisticated cyber intrusion targeting MITRE's research network (NERVE) through the exploitation of Ivanti Connect Secure zero-day vulnerabilities. The threat actor, suspected to be UNC5221, initiated the attack by gaining unauthorized access and subsequently deploying variou…

Published: May 24, 2024

Downloadable IOCs: 4

Protecting Networks from Opportunistic Ivanti Pulse Secure Vulnerability Exploitation

Juniper Threat Labs has observed attempts to exploit Ivanti Pulse Secure authentication bypass and remote code execution vulnerabilities (CVE-2023-46805 and CVE-2024-21887), leading to the delivery of Mirai botnet payloads. This analysis explores the vulnerabilities, exploitation methods, observed …

Published: May 10, 2024

Downloadable IOCs: 23

Tag: CVE-2024-21887

Attack reports

Iran-based Cyber Actors Enabling Ransomware Attacks on US Organizations

Technical Deep Dive: Understanding the Anatomy of a Cyber Intrusion

Protecting Networks from Opportunistic Ivanti Pulse Secure Vulnerability Exploitation