Ivanti has released fixes for two more flaws exploited in an attack on its Connect Secure VPN devices that researchers describe as highly unusual — not because of what the intruder installed, but because of what they did not. The patches, issued on 29 October, follow the 13 October patch of authentication-bypass flaw CVE-2026-104935, after a limited number of customers were already compromised.

The attack was first spotted by Volexity, which tracks the intruder as UTA0576. The group had exploited a fully patched appliance since at least early October, chaining flaws to full administrative control without logging in. Once inside, the attacker stole VPN credentials, pulled limited Active Directory data, and hunted for administrator passwords and BitLocker recovery keys, also capturing LDAP traffic and spraying passwords at accounts.

An attack designed to leave nothing behind

What sets this intrusion apart is discipline. Instead of a web shell or persistent backdoor, the attacker re-ran the whole exploit chain for every command, passing instructions and results inside ordinary web traffic. No command-and-control channel, no implant. Volexity says the attacker also tampered with logs and restored altered files.

That leaves defenders with little to find. Ivanti acknowledges limited indicators of compromise, and researchers warn a clean Integrity Checker result is not proof a device was never hit, since memory-only changes can escape that check. VPN and authentication logs must be hunted instead.

What administrators should do now

Organisations running Connect Secure should patch immediately, check how widely VPN logins are exposed to the internet, and consider credential resets wherever a device may have been touched. The devices guarding remote access are prime targets — and the quietest intruder, who installs nothing, can be hardest to catch.

Sources: The Stack; SecurityAffairs.