Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
Malware Families
Excerpt
Volexity has identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices. Ivanti has published an advisory providing upgrade instructions to customers. Systems exhibiting signs of compromise, such as attempts to move laterally originating from the ICS VPN device, should be forensically investigated to ensure no breach has occurred. In the first week of October 2026, Volexity discovered…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-104935 | High | Score 66/100 | First seen |
| IP | 108.165.147.64 | Medium | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…