Ivanti Zero-Day Chain, FortiGate Implant, and Legal Aid Agency Breach

Three critical security incidents dominate today’s briefing. Ivanti Connect Secure VPN appliances face active exploitation through a three-vulnerability chain granting unauthenticated root access, with particular risk to managed service providers and their client bases. The PEERSTITCH implant campaign reveals how a 2024 FortiManager compromise led to persistent, memory-resident malware on hundreds of FortiGate firewalls, surviving standard detection methods. The Legal Aid Agency breach now confirms exfiltration of nearly 50 years of records, creating direct pretexting risks for legal services firms. Each incident exposes the gap between patching and verification, between logs that appear clean and systems that actually are clean. For small businesses relying on managed IT infrastructure, this episode provides specific questions to ask providers and concrete steps to verify security posture. The NCSC has also published updated guidance on post-quantum cryptography in TLS configurations, signalling the start of a multi-year migration that requires planning rather than crisis response.

Chapters

• Introduction Overview of three major security incidents involving systems left open that shouldn’t have been, and the gap between official accounts and operational reality.
• Ivanti Connect Secure Zero-Day Chain Analysis of three chained zero-day vulnerabilities enabling unauthenticated root access to Ivanti VPN appliances, with particular focus on risks to managed service providers and their client bases. Includes specific verification steps for organisations and their IT providers.
• Listener Call to Action Brief reminder to follow the show and share with colleagues who need threat intelligence updates.
• PEERSTITCH FortiGate Implant Deep dive into a sophisticated intrusion campaign originating from a 2024 FortiManager compromise, leading to deployment of memory-resident malware on hundreds of managed FortiGate firewalls. Explains why standard compromise checks would have missed this threat and what verification steps are actually required.
• Legal Aid Agency Breach Examination of a breach affecting nearly 50 years of records, including probation service data, and the specific pretexting risks this creates for legal services firms and their clients. Covers verification procedures for firms handling legal aid cases.
• NCSC TLS Guidance Update Planning note on newly published NCSC guidance for post-quantum cryptography migration in TLS configurations, framed as a multi-year planning exercise rather than immediate crisis.
• Closing Remarks Summary emphasising the distinction between devices that appear secure and devices that actually are secure, and the importance of asking IT providers how they verify security rather than assuming it.

Links

• https://www.ivanti.com/security
• https://www.paloaltonetworks.com/unit42
• https://www.ncsc.gov.uk/guidance/using-tls-to-protect-data
• https://www.ncsc.gov.uk/guidance/post-quantum-cryptography