In April 2021, investigators reported that attackers had exploited zero-day vulnerabilities in Ivanti Pulse Connect Secure VPN appliances to enter U.S. and European government agencies, defense contractors, financial institutions, and other organizations. A Cybersecurity and Infrastructure Security Agency (CISA) alert said exploitation began in June 2020 or earlier and affected U.S. government agencies, critical-infrastructure entities, and private-sector organizations. The attackers were suspected of being backed by China, but that attribution was not established in the supplied account; China denied responsibility and accused the United States of extensive hacking and surveillance.
Ivanti said only a “limited number” of customers had been compromised, while Mandiant CFO Charles Carmakal described the incident as significant because unauthorized access to federal and corporate systems could persist for months. Ivanti initially said a full patch would not be available until May, and released it on May 3, 2021. CISA subsequently issued an emergency directive requiring federal agencies to install the updates. The episode underscored the systemic risk of internet-facing VPN appliances: one unpatched product could provide a foothold inside sensitive networks, even though the supplied source gives no confirmed victim total or financial-loss figure.
