OPEN-SOURCE TOOLKIT OF AN IVANTI CSA ATTACKER

Summary from the TLDR InfoSec newsletter

In late 2024, Ivanti released advisories for vulnerabilities in its Cloud Services Appliance (CSA) product, which were discovered to be part of an exploit chain against the products. In this post, Synacktiv researchers break down three of the open-source tools they observed used by attackers in post-exploitation activities on these devices and provide YARA rules to detect them. The attacker planted Suo5 after the initial compromise as a webshell to be used on an internet-facing Exchange server. The attacker then established persistence using the iox tunnel and attempted lateral movement using atexec.py to gain remote code execution via Task Scheduler.