Ivanti Connect Secure

In the first quarter of 2025, Ivanti Connect Secure suffered a significant ransomware attack. Threat actors targeted the company with a zero-day exploit purchased for $200,000, resulting in unauthorized remote code execution. The attack led to sensitive data exfiltration and resulted in leak site posts threatening to disclose the information if the ransom was not paid. The attack demonstrated the financial maturity of the ransomware groups, showing their ability to reinvest in sophisticated tools to perpetrate more advanced attacks. Ivanti Connect Secure experienced substantial data compromise, reputational damage, and financial implications due to the breach. This incident underscores the urgent need for enhanced cyber defenses and proactive security measures.

Source: https://cybersecuritynews.com/ransomware-groups-attacking-organizations/

TPRM report: https://scoringcyber.rankiteo.com/company/pulse-secure

"id": "pul707041025",
"linkid": "pulse-secure",
"type": "Ransomware",
"date": "4/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'name': 'Ivanti Connect Secure', 'type': 'Company'}],
 'attack_vector': ['Zero-day exploit', 'Unauthorized remote code execution'],
 'data_breach': {'data_exfiltration': 'Yes',
                 'type_of_data_compromised': 'Sensitive data'},
 'date_detected': 'Q1 2025',
 'description': 'In the first quarter of 2025, Ivanti Connect Secure suffered '
                'a significant ransomware attack. Threat actors targeted the '
                'company with a zero-day exploit purchased for $200,000, '
                'resulting in unauthorized remote code execution. The attack '
                'led to sensitive data exfiltration and resulted in leak site '
                'posts threatening to disclose the information if the ransom '
                'was not paid. The attack demonstrated the financial maturity '
                'of the ransomware groups, showing their ability to reinvest '
                'in sophisticated tools to perpetrate more advanced attacks. '
                'Ivanti Connect Secure experienced substantial data '
                'compromise, reputational damage, and financial implications '
                'due to the breach. This incident underscores the urgent need '
                'for enhanced cyber defenses and proactive security measures.',
 'impact': {'brand_reputation_impact': 'Reputational damage',
            'data_compromised': 'Sensitive data'},
 'lessons_learned': 'Enhanced cyber defenses and proactive security measures '
                    'are needed.',
 'motivation': 'Financial',
 'ransomware': {'data_exfiltration': 'Yes'},
 'title': 'Ivanti Connect Secure Ransomware Attack',
 'type': 'Ransomware',
 'vulnerability_exploited': 'Zero-day exploit'}