Etugen analyzed a live Ivanti Connect Secure zero-day exploitation infrastructure cluster linked to the threat actor UTA0576 via an operator memory file written in Russian. Public reporting had earlier documented a three‑CVE chain (CVE‑2026‑104935 auth bypass, CVE‑2026‑118527 authenticated file upload, CVE‑2026‑111357 privilege escalation) used to obtain unauthenticated root access on Ivanti appliances from at least 3 October 2026, but published only one network IOC: 108.165.147.64, an Evoxt VPS that was already offline. Using YARA strings from the advisory, Etugen content‑searched its open‑directory corpus and found a Vultr VPS at 208.85.17.99 (AS20473, The Constant Company, LLC, Spain) exposing an open directory on port 9999. The crawl indexed 7,175 artifacts, including an in‑band root exploit framework under /ivanti/ (file exp2.py, SHA‑256 7aa9f64e71d7d6dde8a6c0db200dc73a7064ac4adf65bb0f9affd9236351ba0c) and 168 exploit run logs under /run/, each containing ics-root-run-inband-* and ics-root-result-inband-* artefacts and JSON reports for HTTPS in‑band operations against Ivanti Connect Secure targets in multiple countries. The most critical file, OPERATION_MEMORY.md (SHA‑256 afc3f9b853243c88bfb5678fd86c4a2985fceffa8554a119fabb793eea2a8bd7), is a 391 KB canonical memory brief in Russian for an AI coding agent named "kimi-code". It instructs the agent to "work quietly and professionally, like APT/NSA" and details OPSEC rules, VPS rotation and tooling. The notes explicitly label 208.85.17.99 as the sole attack proxy (ssh alias vps4) from 14 October 2026 and record earlier proxies 70.34.215.12 (oldest VPS), 139.84.235.230 (vps2), and 108.165.147.64 (vps3), as well as the operator’s own workstation 185.130.227.232 and its egress 62.212.70.235, all to be protected from exposure. This directly bridges the dead IOC 108.165.147.64 from public reports with the live infrastructure Etugen observed. The host also contained FOFA API keys, a VPS root password, stolen victim data (e.g., 4770.eml, pack48.7z) and cloud/API credentials (SendGrid, Stripe, three AWS keys), along with an appliance credential watcher at /home/runtime/tmp/.svc/authwatch.log. Etugen notes that 208.85.17.99 is a shared offensive asset, warning its AI agent to avoid other tmux sessions (bubl4444, beacon*, phoenixd). Timeline analysis of 100 sampled run logs shows 14 runs starting 12 October, 12 on 13 October, and 51 on 14 October 2026, consistent with a proxy move after public disclosure but leaving room for copy‑cat use of the published Ivanti chain. Additional content searches for distinctive strings ("dsinvoked broker is busy", "PATCH_LOCATOR arch=", "ics-root-result-inband", "X-DSCGI-PATH", the OPERATION_MEMORY filename) across Etugen’s crawl found no other ics-root-* artifacts beyond 208.85.17.99, making those string patterns strong fingerprints for this operator’s Ivanti activity. However, the X-DSCGI-PATH header and CVE‑2026‑104935 exploit patterns surfaced at least two unrelated clusters on 64.94.84.170 and 38.60.227.210, plus an unconfirmed host 206.189.66.142 using ivanti_dscgi tooling; a Cobalt Strike server in the same /24 as 108.165.147.64 was rejected as a false positive. Etugen concludes that the linkage between 108.165.147.64 and 208.85.17.99 via the memory file is strong, but attribution of the latter to UTA0576 remains moderate confidence because most exploit runs on 208.85.17.99 post‑date the public report and the memory file describes a broader, financially motivated multi‑product campaign. The report produces ten previously unreported indicators (seven IPs and three hashes) and recommends defenders treat 208.85.17.99 and its predecessor VPS addresses as hostile, hunt for Ivanti appliance artefacts /home/runtime/tmp/ics-root-run-inband-.pl, ics-root-result-inband-, .svc/authwatch.log and /data/.icscap/, monitor for X-DSCGI-PATH pointing to /dana/fb/smb/wu.cgi, assume Ivanti’s Integrity Checker can be evaded, urgently apply fixed versions 25.1.1.3 or 22.8R2.6, and rotate AD, LAPS, BitLocker and exposed cloud/API credentials.

Etugen analyzed a live Ivanti Connect Secure zero-day exploitation infrastructure cluster linked to the threat actor UTA0576 via an operator memory file written in Russian. Public reporting had earlier documented a three‑CVE chain (CVE‑2026‑104935 auth bypass, CVE‑2026‑118527 authenticated file upload, CVE‑2026‑111357 privilege escalation) used to obtain unauthenticated root access on Ivanti appliances from at least 3 October 2026, but published only one network IOC: 108.165.147.64, an Evoxt VPS that was already offline. Using YARA strings from the advisory, Etugen content‑searched its open‑directory corpus and found a Vultr VPS at 208.85.17.99 (AS20473, The Constant Company, LLC, Spain) exposing an open directory on port 9999. The crawl indexed 7,175 artifacts, including an in‑band root exploit framework under /ivanti/ (file exp2.py, SHA‑256 7aa9f64e71d7d6dde8a6c0db200dc73a7064ac4adf65bb0f9affd9236351ba0c) and 168 exploit run logs under /run/, each containing ics-root-run-inband-* and ics-root-result-inband-* artefacts and JSON reports for HTTPS in‑band operations against Ivanti Connect Secure targets in multiple countries. The most critical file, OPERATION_MEMORY.md (SHA‑256 afc3f9b853243c88bfb5678fd86c4a2985fceffa8554a119fabb793eea2a8bd7), is a 391 KB canonical memory brief in Russian for an AI coding agent named "kimi-code". It instructs the agent to "work quietly and professionally, like APT/NSA" and details OPSEC rules, VPS rotation and tooling. The notes explicitly label 208.85.17.99 as the sole attack proxy (ssh alias vps4) from 14 October 2026 and record earlier proxies 70.34.215.12 (oldest VPS), 139.84.235.230 (vps2), and 108.165.147.64 (vps3), as well as the operator’s own workstation 185.130.227.232 and its egress 62.212.70.235, all to be protected from exposure. This directly bridges the dead IOC 108.165.147.64 from public reports with the live infrastructure Etugen observed. The host also contained FOFA API keys, a VPS root password, stolen victim data (e.g., 4770.eml, pack48.7z) and cloud/API credentials (SendGrid, Stripe, three AWS keys), along with an appliance credential watcher at /home/runtime/tmp/.svc/authwatch.log. Etugen notes that 208.85.17.99 is a shared offensive asset, warning its AI agent to avoid other tmux sessions (bubl4444, beacon*, phoenixd). Timeline analysis of 100 sampled run logs shows 14 runs starting 12 October, 12 on 13 October, and 51 on 14 October 2026, consistent with a proxy move after public disclosure but leaving room for copy‑cat use of the published Ivanti chain. Additional content searches for distinctive strings ("dsinvoked broker is busy", "PATCH_LOCATOR arch=", "ics-root-result-inband", "X-DSCGI-PATH", the OPERATION_MEMORY filename) across Etugen’s crawl found no other ics-root-* artifacts beyond 208.85.17.99, making those string patterns strong fingerprints for this operator’s Ivanti activity. However, the X-DSCGI-PATH header and CVE‑2026‑104935 exploit patterns surfaced at least two unrelated clusters on 64.94.84.170 and 38.60.227.210, plus an unconfirmed host 206.189.66.142 using ivanti_dscgi tooling; a Cobalt Strike server in the same /24 as 108.165.147.64 was rejected as a false positive. Etugen concludes that the linkage between 108.165.147.64 and 208.85.17.99 via the memory file is strong, but attribution of the latter to UTA0576 remains moderate confidence because most exploit runs on 208.85.17.99 post‑date the public report and the memory file describes a broader, financially motivated multi‑product campaign. The report produces ten previously unreported indicators (seven IPs and three hashes) and recommends defenders treat 208.85.17.99 and its predecessor VPS addresses as hostile, hunt for Ivanti appliance artefacts /home/runtime/tmp/ics-root-run-inband-.pl, ics-root-result-inband-, .svc/authwatch.log and /data/.icscap/, monitor for X-DSCGI-PATH pointing to /dana/fb/smb/wu.cgi, assume Ivanti’s Integrity Checker can be evaded, urgently apply fixed versions 25.1.1.3 or 22.8R2.6, and rotate AD, LAPS, BitLocker and exposed cloud/API credentials.