ThreatRoundup

UTA0576 (Volexity designation)

Unknown actor that chained three Ivanti Connect Secure zero-days to root in October 2026, then stole LAPS passwords and BitLocker keys; Volexity suspects LLM-built tools.

Threat actor profile · Updated

Active
October 2026 to October 2026
Affiliates
None reported; Volexity notes a shared LDAP packet-capture technique with UTA0533 but does not link the clusters
Regions targeted
Not disclosed

Profile

UTA0576 is a label, not yet a profile. Volexity created it in October 2026 for an unknown attacker it caught exploiting a chain of Ivanti Connect Secure zero-days at one of its network security monitoring customers, and its October 13 report is so far the only primary source on the group. Volexity gives no country of origin and no earlier activity. It assesses with low confidence that the attacker is criminally motivated rather than an espionage operator, based on what it went after, and no other vendor has published a name for the cluster.

What is known is the exploit work, and it is sophisticated. Exploitation began on October 3, 2026. The chain started with CVE-2026-104935, an authentication bypass and code execution bug: a request to the public login script carried a header that decided which protected script it reached, landing on an upload handler that wrote a file before checking it, which the attacker won by racing parallel requests. A second bug, CVE-2026-111357, gave root by abusing a root-run service’s trust in cached configuration after patching a library in memory (T1068 (Exploitation for Privilege Escalation)). CyberSecurityNews lists a third, CVE-2026-118527, for a predictable upload filename. All three are in CISA’s Known Exploited Vulnerabilities catalog, and Ivanti finished patching on October 29.

The post-exploitation behavior is unusual. The attacker never installed a web shell or backdoor; it re-ran the whole exploit chain for each command. With root on the appliance it used the VPN’s own Active Directory service account to pull LAPS passwords, BitLocker recovery keys and password-bearing attributes over LDAP (T1087.002 (Account Discovery: Domain Account)), carried a Kerberoasting-capable tool (T1558.003 (Steal or Forge Kerberos Tickets: Kerberoasting)), ran a renamed tcpdump to capture LDAP, HTTP Basic and NTLM credentials off the wire (T1040 (Network Sniffing)) and password-sprayed accounts (T1110.003 (Brute Force: Password Spraying)). It then cut its entries out of the debug and audit logs and put back what it had changed in memory, so Ivanti’s Integrity Checker Tool would not flag the device.

Volexity assesses with medium confidence that the attacker used large language models to build its exploits and tools, pointing to the many narrowly scoped scripts with hardcoded credentials and the complexity of the chain. It also notes that the LDAP packet-capture trick was used recently by UTA0533, a separate cluster that exploited SonicWall SMA zero-days; Volexity does not say the two are the same actor.

Events

Date Target Narrative Source Our coverage
2026-10-30 Ivanti Connect Secure customers CISA adds CVE-2026-111357 and CVE-2026-118527 to the Known Exploited Vulnerabilities catalog, joining CVE-2026-104935 (added October 13). Ivanti released the last fix, for the privilege escalation, on October 29. The Hacker News Our story
2026-10-03 to 2026-10 Volexity network security monitoring customer (sector and country not disclosed) Unauthenticated exploit chain to root on a fully patched Connect Secure appliance (T1190 (Exploit Public-Facing Application)), then LDAP theft of LAPS passwords and BitLocker keys through the appliance’s AD service account, packet capture, Kerberos tooling, password spraying and selective log deletion. Ivanti confirmed a limited number of affected customers. Volexity Our story

Target vectors risk profile

Edge devices/VPNs Cloud/identity Ransomware/extortion Espionage Software supply chain
High High Low Low N/A

Malware and tools

Name What it does Public detection Hunt Leads Reports
Custom Python LDAP and Kerberos tools (ml.py, rq5.py, mk.py, rr.py) Query Active Directory for LAPS passwords, BitLocker recovery data and password attributes; test credentials, with Kerberoasting code included Indicators on Volexity’s GitHub Volexity
sp_run.py Password-spraying script that writes hits to spray_hits.json Indicators on Volexity’s GitHub Volexity
tcpdump (renamed dsstatmond) and h.py Legitimate packet capture tool hidden under an Ivanti process name, plus a parser that pulls LDAP, HTTP Basic and NTLM credentials from the captures Indicators on Volexity’s GitHub Volexity

Reports

Date Source Report
2026-10-31 The Hacker News Attackers chain three Ivanti Connect Secure flaws to gain unauthenticated root access
2026-10-30 CyberSecurityNews Ivanti Connect Secure 0-days exploited in the wild to gain unauthenticated root access
2026-10-13 Volexity A series of unauthenticated events: chained exploitation of Ivanti Connect Secure zero-days
2026-10-13 Ivanti Security advisory: Ivanti Connect Secure (CVE-2026-104935)
2026-10-13 Volexity Indicators of compromise (GitHub)

Vulnerabilities exploited

Vulnerability CVSS Severity Publisher Platform CISA KEV
CVE-2026-104935 8.6 High Ivanti Connect Secure Yes
CVE-2026-111357 7.0 High Ivanti Connect Secure Yes
CVE-2026-118527 not disclosed not disclosed Ivanti Connect Secure Yes

If you’re in their sights

Do this now

  1. Upgrade Connect Secure to Ivanti’s fixed release for your branch (22.8R2.6 or 25.1.1.3 per the reporting), and check the advisory if you run another branch.
  2. Don’t treat a clean Integrity Checker result as proof the appliance is safe. Look for heavy request volumes to welcome.cgi, requests whose X-DSCGI-PATH header doesn’t match the URL, and leftover scripts in /tmp.
  3. Limit what the VPN’s Active Directory service account can read: it should not be able to see LAPS passwords or BitLocker recovery keys.
  4. If you find signs of compromise, rotate that service account, all LAPS passwords and BitLocker recovery keys, and reset passwords for accounts that authenticated through the appliance.

Compiled from Volexity, Ivanti, CyberSecurityNews and The Hacker News, plus ThreatRoundup reporting. Last reviewed November 1, 2026.

ThreatRoundup coverage

2 of these stories have Hunt Leads: detection-ready leads for threat hunters.

ATT&CK techniques and software from MITRE ATT&CK (v20.0); vendor names from MITRE ATT&CK and the MISP galaxy. © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MISP galaxy content is CC0 / BSD-2-Clause.