{"id":11469,"date":"2025-07-20T12:35:42","date_gmt":"2025-07-20T05:35:42","guid":{"rendered":"https:\/\/infosec.new88088.net\/?p=11469"},"modified":"2026-06-25T10:00:16","modified_gmt":"2026-06-25T03:00:16","slug":"hackers-exploiting-ivanti-vulnerabilities-to-spread-malicious-code-and-deploy-cobalt-strike","status":"publish","type":"post","link":"https:\/\/infosec.new88088.net\/en\/2025\/07\/20\/hackers-exploiting-ivanti-vulnerabilities-to-spread-malicious-code-and-deploy-cobalt-strike\/","title":{"rendered":"Hackers exploiting Ivanti vulnerabilities to spread malicious code and deploy Cobalt Strike"},"content":{"rendered":"
Recently, cybersecurity experts discovered a new type of malware called MDifyLoader, which is used in cyberattacks targeting Ivanti Connect Secure (ICS) devices.<\/b>
\n\u200b<\/div>\n
\"1752982631336.png\"<\/a>\u200b<\/div>\n
\n

Discovered between December 2024 and July 2035, this attack exploits two security vulnerabilities in the ICS to infect and spread dangerous malicious codes such as Cobalt Strike, VShell and Fscan:<\/p>\n

MDifyLoader is a loader designed to load other malware into the system’s memory. The software is based on the open source libPeConv project and performs the download and decryption of an encrypted Cobalt Strike Beacon payload.<\/p>\n

Download and decode MDifyLoader: Once access is granted, the MDificateLOader is loaded into memory, loading an encrypted Cobalt Strike Beacon payload.<\/p>\n

Lateral movement: After gaining access to the system, hackers perform brute-force attacks on FTP, MS-SQL and SSH to steal passwords and data.<\/p>\n

Cobalt Strike is a powerful tool, commonly used in cyberattacks to remotely control systems and deploy complex attack operations. The Cobalt Strike Beacon can allow hackers to maintain access to an infiltrated system and perform stealth activities that the user is unaware of.<\/p>\n

Taking advantage of other tools: Tools such as VShell and Fscan are used to maintain control and scan additional network devices to expand the range of attacks.<\/p>\n

VShell: A remote control tool (RAT) written in Go, used to maintain access to the system. VShell checks the system language to determine if it is a Chinese user, before taking action.<\/p>\n

Fscan: A network scanning tool written in Go, which helps hackers scan devices and systems in a network to search for vulnerabilities and expand the range of attacks.<\/p>\n

The attack process can be described as follows: The vulnerability in Ivanti Connect Secure (ICS), a VPN device widely used in businesses, is the starting point for this attack sequence. The following two serious security vulnerabilities have been exploited by hackers:<\/p>\n<\/div>\n