kyber.today

daily cyber × ai intelligence

← threat actors

threat actor

UTA0576

3 stories · 2 in the wild · October 14, 2026 – November 3, 2026

evidence: 2 observed · 1 disclosed

sectors

  • defense 1 · Oct 14

techniques

  • privilege escalation 2 · Nov 3
  • auth bypass 2 · Nov 2
  • credential access 2 · Nov 2
  • file upload 1 · Nov 3
  • race condition 1 · Oct 14

attack phases seen

  • Initial access 3 · Nov 3
  • Privilege escalation 2 · Nov 3
  • Credential access 2 · Nov 2
  • Exfiltration 1 · Oct 14

what we reported, newest first, grouped by story

Oct 14 – November 3, 2026 · 3 reports

  • Ivanti Connect Secure: Volexity attributes the chain to UTA0576, which gained unauthenticated root on an appliance running 22.8R2.4 beginning October 3 (Rapid7) (earlier coverage). CVE-2026-111357 (local authenticated privilege escalation) and CVE-2026-118527 (remote authenticated file upload to a known path) chain with the authentication bypass CVE-2026-104935; both were added to KEV on October 30. Fixed in 25.1.1.3 and 22.8R2.6 — Rapid7 recommends post-patch compromise hunting, and NCSC-NL has raised the advisory to high/high (NCSC-NL). · Nov 3 · observed · Vulnerabilities & Exploitation
  • Ivanti Connect Secure federal remediation deadlines land today and on November 13 for CVE-2026-111357 and CVE-2026-118527, the two flaws CISA added to KEV on Friday. Volexity documented them as part of the UTA0576 chain alongside auth bypass CVE-2026-104935, giving unauthenticated root on fully patched appliances; post-exploitation went after AD credentials, LAPS passwords and BitLocker recovery keys. Patches now exist for all three (25.1.1.3, 22.8R2.6) (Security Affairs, earlier coverage). · Nov 2 · disclosed · Vulnerabilities & Exploits
  • Ivanti Connect Secure is under active in-the-wild exploitation via CVE-2026-104935, an authentication bypass plus race-condition RCE chained with a separate privilege-escalation bug to reach root. Volexity says UTA0576 hit a fully patched 22.8R2.4 appliance on 3 October 2026; notably the actor deployed no web shell or backdoor, going straight for credential theft and data exfiltration (Volexity, Ivanti advisory). Ivanti has patched two of the three; a fix for the third is still pending per Volexity (The Hacker News). CISA added it to KEV the same day (CISA); NCSC-NL notes no public PoC yet but expects one shortly (NCSC-NL). @watchtowrcyber says it is actively notifying platform clients of exposure. (discussion) · Oct 14 · observed · Vulnerabilities & Exploits