Loading threat actor…
UTA0576 is a threat actor identified by Volexity exploiting Ivanti Connect Secure VPN appliances since at least October 3, 2026. Its geographic origin, organizational affiliation, and ultimate objectives are unknown. The actor compromised an appliance running the then-fully-patched version 22.8R2.4 through a three-vulnerability zero-day chain combining authentication bypass, a file-upload race condition enabling remote code execution, and privilege escalation. The authentication-bypass and remote-code-execution components are jointly tracked as CVE-2026-104935. Abuse of the privileged dsinvoked service and DSCache configuration data elevated execution to root. UTA0576 repeatedly executed the complete exploit chain to issue commands and retrieve results through HTTPS responses rather than installing a persistent backdoor or web shell. Its defense-evasion techniques included transient in-memory library modifications, restoration of altered configuration, selective deletion of debug and audit log entries, and cleanup of temporary execution artifacts. These techniques left changes that Ivanti’s disk-based Integrity Checker Tool did not detect. Post-exploitation activity included theft of credentials and appliance configuration data, host and network reconnaissance, Active Directory enumeration, credential testing, and password spraying. The actor used the appliance’s compromised directory service account and custom Python LDAP tooling to search for Windows LAPS passwords, BitLocker recovery information, and password-bearing account attributes. It also captured network traffic and deployed parsing tools to recover plaintext credentials and NTLM challenge-response hashes. Its custom Kerberos tooling included Kerberoasting capability. Directory-query results and other collected data were exfiltrated through the exploit channel. The activity indicated preparation for lateral movement and broader network compromise, but the operation was disrupted before its ultimate objectives were established.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
UTA0576 exploited Ivanti Connect Secure appliances using a vulnerability chain to achieve unauthenticated root-level code execution. Volexity observed the activity since at least October 3, 2026, with post-exploitation actions targeting Active Directory credentials and secrets, including LAPS passwords and BitLocker recovery keys. The actor's origin and sponsorship are not identified.
UTA0576 is assessed as criminally motivated rather than espionage-driven. It exploited Ivanti Connect Secure appliances to obtain root-level code execution, steal stored credentials, exfiltrate limited Active Directory metadata, and conduct reconnaissance and credential-focused post-exploitation activity. Recovered payloads showed deliberate concealment through log modification, artifact removal, and restoration of altered system state.
UTA0576 compromised an Ivanti Connect Secure VPN appliance using three chained zero-day vulnerabilities to obtain unauthenticated root access. Active since at least October 3, 2026, the actor conducted reconnaissance, stole credentials, and exfiltrated data while avoiding persistent backdoors and suppressing forensic evidence. Volexity assessed with high confidence that these activities prepared for lateral movement and broader network compromise, but disruption prevented determination of the actor’s ultimate objectives. Its identity, origin, and sponsorship are not established in the content.
UTA0576 compromised Ivanti Connect Secure VPN appliances using a three-vulnerability exploit chain, stealing credentials and configuration data and conducting network reconnaissance. The earliest confirmed activity was October 1, 2026. Volexity assessed with high confidence that the activity prepared for lateral movement and broader network compromise, but disruption prevented determination of the actor’s ultimate objectives. A criminal rather than espionage motivation was assessed with low confidence.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.