Threat Actor
UTA0576
- First Reported
- Oct 13, 2026
- Latest Reported
- Oct 13, 2026
Reported Context (4)
- Volexity-tracked threat actor that chained three zero-days against a fully patched Ivanti Connect Secure appliance; exploitation was reported at a limited number of customers. Ivanti Zero-Day Chain Enabled Root Access to Fully Patched VPN Appliances
- Volexity tracks UTA0576 as the attacker that exploited the Ivanti Connect Secure flaws; Volexity assessed with low confidence that its motive was criminal rather than espionage. Ivanti Connect Secure Zero-Day Chain Enables Unauthenticated Root Access; Third Fix Pending
- Threat actor Volexity observed exploiting Ivanti Connect Secure zero-days and conducting post-exploitation activity. Ivanti Connect Secure Zero-Days Chained for Unauthenticated Root Access
- Volexity's tracking name for the threat actor that exploited the vulnerabilities to compromise Ivanti Connect Secure appliances. Attackers Exploited Ivanti Connect Secure Zero-Days Before a Patch Was Available
CVE (3)
People (2)
Threat Actors (1)
MITRE ATT&CK (10)
Vendors (1)
Products (7)
Tools (3)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.