Ivanti ICS Zero-Day Exploited to Deploy DslogdRAT as CISA Adds Flaw to KEV Catalog

A newly discovered zero-day vulnerability in Ivanti Connect Secure (ICS) VPN appliances is being actively weaponized by threat actors, prompting urgent action from cybersecurity authorities and enterprise security teams. Tracked as CVE-2025-0282, the critical flaw has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog following confirmed attacks deploying the DslogdRAT malware.

Technical Analysis of the Threat

The vulnerability exists in the web component of Ivanti ICS (formerly Pulse Secure), allowing unauthenticated remote code execution. Attack chains observed in Japan demonstrate sophisticated exploitation:

1. Initial compromise via CVE-2025-0282
2. Deployment of web shells for persistence
3. Lateral movement using stolen credentials
4. Final payload delivery including DslogdRAT

DslogdRAT exhibits advanced capabilities including:

• Keylogging
• Screen capture
• Command execution
• Data exfiltration
• Proxy tunneling

Response and Mitigation

CISA has mandated all federal civilian agencies to patch affected systems by February 15, 2025, though commercial enterprises should treat this as equally urgent. Ivanti has released mitigation guidance recommending:

1. Immediate application of temporary workarounds
2. Network segmentation of VPN appliances
3. Enhanced monitoring for web shell activity
4. Credential rotation for all potentially exposed accounts

Security Implications

This incident continues a troubling pattern of VPN appliance vulnerabilities being rapidly weaponized. The combination of:

• Perimeter device compromise
• Privileged network position
• Credential harvesting opportunities

makes these attacks particularly dangerous for enterprises. Organizations using Ivanti ICS should assume compromise and conduct thorough investigations, not just apply patches.