2021): CISA has updated this alert to include new threat actor techniques, tactics, and procedures (TTPs), indicators of compromise (IOCs), and updated mitigations. CISA strongly encourages organizations using Ivanti Pulse Connect Secure appliances to immediately run the Pulse Secure Connect Integrity Tool, update to the latest software version, and investigate for malicious activity. The known webshells allow for a variety of functions, including authentication bypass, multi-factor authentication bypass, password logging, and persistence through patching. The threat actor is using this access to place webshells on the Pulse Connect Secure appliance for further access and persistence.

To gain initial access, the threat actor is leveraging multiple vulnerabilities, including CVE-2019-11510, CVE-2020-8260, CVE-2020-8243, and the newly disclosed CVE-2021-22893.

These entities confirmed the malicious activity after running the Pulse Secure Connect Integrity Tool. Since March 31, 2021, CISA and Ivanti have assisted multiple entities whose vulnerable Pulse Connect Secure products have been exploited by a cyber threat actor. government agencies, critical infrastructure entities, and other private sector organizations by a cyber threat actor-or actors-beginning in June 2020 or earlier related to vulnerabilities in certain Ivanti Pulse Connect Secure products. It appears when switching from Z-Tunnel 2.0 to 1.0 or to disable ZIA completely, it fails and only likes when it remains on Z-Tunnel 1.0 throughout the connection.The Cybersecurity and Infrastructure Security Agency (CISA) is aware of compromises affecting a number of U.S.

tried Tunnel with Local Proxy for VPN Trusted Network - fails.

added the DNS domain of the 3rd party to the DNS search suffix so it’s detected as VPN Trusted Network and set to None (disabled) - fails.

added the DNS domain of the 3rd party to the DNS search suffix so it drops down to Tunnel 1.0 - fails.

The VPN destination is in the App PAC, Fwd PAC, VPN Gateway Bypass and still fails.

Off Trusted Network: Same as On Trusted Network.

VPN Trusted Network: Same as On Trusted Network.

Tunnel Driver Type: Packet Filter Based.

The connection is not established fully and both Pulse Secure and ZCC go into Connecting and Connected state. Everything works in Tunnel 1.0 configuration but we are making a move to Tunnel 2.0 where it fails to function. We have a number of users that use Pulse Secure VPN client to connect to a 3rd party, which is configured in Full Tunnel mode.

Pulse connect secure juniper