Superseded
Over 1,700 Ivanti Connect Secure devices were compromised
Assessment
Volexity's 15 January 2024 count came from scanning about 30,000 Connect Secure IP addresses for the GIFTEDVISITOR web shell. On 18 January Volexity added 368 more, taking the total past 2,100. Both figures count one web shell family on one date; appliances carrying other backdoors, or cleaned before the scan, are outside them. The 1,700 number is still widely repeated as the campaign total.
Where this claim appeared
Volexity · 2024-01-15
https://www.volexity.com/blog/2024/01/15/ivanti-connect-secure-vpn-exploitation-goes-global/What “Superseded” means
Reported accurately at the time, then corrected by the original source. Recorded because the original version usually continues circulating long after the correction.
2 of 5 · rating scale
Assessed in
Ivanti Connect Secure zero-days: one December intrusion, 2,100 backdoored appliances and a federal disconnect orderThink this assessment is wrong? Report an error.