UTA0576
Volexity's tracking label for an unidentified actor that exploited Ivanti Connect Secure zero-days.
UTA0576 used three Ivanti Connect Secure flaws in sequence from 3 October 2026, Volexity reported; Ivanti disclosed the first ten days later while the final link remained unpatched.
Last refreshed: 22 October 2026 · Appears in 1 active topic
Who is UTA0576, and where will it reuse the stolen credentials?
Timeline for UTA0576
Exploited three Connect Secure flaws as zero-days
Cybersecurity: Threats and Defences: UTA0576 hit Ivanti VPNs before a fixBackground
UTA0576 is Volexity's tracking label for an unidentified actor that exploited Ivanti Connect Secure from 3 October 2026. It chained an authentication bypass, Remote Code Execution and privilege escalation to gain root access without credentials.
The actor stole directory credentials, Windows local administrator passwords and BitLocker recovery keys, then prepared for movement into the wider network. It repeatedly used the exploit chain instead of installing a lasting web Shell, deleted logs and restored code changed in memory.
Volexity assesses a criminal motive over espionage with low confidence. The actor's identity, location and ultimate objective remain unknown. Volexity states those limits explicitly.
UTA0576 exploits Ivanti before disclosure
UTA0576 began its observed Ivanti campaign on 3 October 2026. Volexity said the actor combined three Connect Secure flaws before Ivanti disclosed the first on 13 October. The final link still lacked a patch when the activity became public.
The intruder operated only in memory, so Ivanti's checker did not detect it. UTA0576 took directory credentials and administrator passwords. Those credentials can remain valid after an appliance upgrade until defenders change them, leaving substantial operational response work beyond applying the available fixes.
Who is UTA0576?
How did UTA0576 breach Ivanti Connect Secure?
What did UTA0576 steal?
What government is UTA0576 linked to?
Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 22 October 2026. Editorial standards.