By Matt Kapko Senior Reporter CISA, cybersecurity, agency
The Cybersecurity and Infrastructure Security Agency was hit by a cyberattack earlier this year after a yet-to-be identified threat actor intruded the agency’s systems by exploiting critical vulnerabilities in Ivanti products.
“About a month ago, CISA identified activity indicating the exploitation of vulnerabilities in Ivanti products the agency uses,” a CISA spokesperson told Cybersecurity Dive Friday. Threat actors started widely exploiting a pair of zero-day vulnerabilities in Ivanti Connect Secure and other remote access VPNs in early December.
“The impact was limited to two systems, which we immediately took offline. We continue to upgrade and modernize our systems, and there is no operational impact at this time,” the spokesperson said.
CISA declined to provide additional details about the attack.
The Infrastructure Protection Gateway and Chemical Security Assessment Tool were reportedly compromised during the attack, according to The Record, which first reported the news.
Federal and international cyber authorities issued a global alert in late February warning that critical vulnerabilities in Ivanti Connect Secure and Policy Secure were still under active exploitation.
CISA ordered federal civilian executive branch agencies to disconnect Ivanti products from agency systems on Feb. 2. By Feb. 6, exploitation was widespread, hitting every exposed Ivanti Connect Secure VPN instance, Shadowserver Foundation CEO Piotr Kijewski told Cybersecurity Dive.
Ivanti released a security patch on Jan. 31 for the zero-day vulnerabilities, CVE-2023-46805 and CVE-2024-21887, after weeks of exploitation activity.
“Ivanti doesn’t have anything further at this time beyond its prior statement and public blog posts,” a spokesperson for Ivanti said Monday.
“This is a reminder that any organization can be affected by a cyber vulnerability and having an incident response plan in place is a necessary component of resilience,” the CISA spokesperson said. “We strongly urge all organizations to review our latest Ivanti advisory and take the steps outlined in it to protect their systems.”
