Ivanti Connect Secure Zero-Day Draws 105 Honeypot Probes as UTA0576 Targets Edge Appliances

The vulnerability permits unauthenticated remote code execution via the X-DSCGI-PATH header on Connect Secure appliances. Volexity traced initial activity to October 3 by actor UTA0576, who chained it with a privilege escalation flaw to extract credentials, perform Kerberoasting, and capture LDAP traffic while selectively editing logs. Federal agencies must patch by October 16, 2026, with version 22.8 reaching end-of-life in January 2027. Previdian observed scripts uploaded as disguised ZIP files returning execution markers, indicating reconnaissance rather than immediate malware deployment. This matches a documented pattern where attackers first validate access on exposed VPN and management appliances before escalating. Official statements emphasize memory forensics for detection, yet omit that many retail and logistics networks route remote access for refrigeration controls and cold-chain telemetry through the same Ivanti gateways. Coverage focused on the honeypot count and CISA advisory but missed the appliance class risk: these devices often sit at the edge of operational networks with minimal segmentation. Similar neglect appears in supermarket refrigeration controllers that rely on legacy remote management stacks. Once weaponized payloads appear, the blast radius extends beyond corporate VPNs into temperature-sensitive supply chains where downtime directly affects food safety and inventory. Next steps include factory resets followed by configuration restores and credential rotation across all linked domains. Independent monitoring of the listed IPs (216.73.160.59, 45.8.19.111) will show whether UTA0576 shifts from testing to persistent access within the next 72 hours.