VPN users beware — security flaws are being exploited to spread dangerous malware

A computer being guarded by cybersecurity.

Users of Ivanti’s Connect Secure (ICS) virtual private network (VPN) devices beware - the solutions carry two high severity vulnerabilities that are being chained together to deliver the Silver malware. 

First things first - the two vulnerabilities being abused here are tracked as CVE-2023-46805, and CVE-2024-21887. The former carries a severity score of 8.2, while the latter 9.1. Researchers from Volexity first spotted these two being abused in early December 2023, claiming that Chinese state-sponsored threat actors abused them as zero-days.