UTA0576: 6 Things to Know About 2026’s Newest Emerging Threat Actor
Table of contents
What does a brand-new threat actor look like when it emerges in October 2026? In the case of UTA0576, it looks like three undisclosed zero-day vulnerabilities, administrative access to a fully patched VPN appliance, direct harvesting of Active Directory credentials and BitLocker recovery keys, and tradecraft that leaves no malware and no web shell behind. It also looks like the second named threat actor Volexity has identified this year using an almost identical playbook against the same category of enterprise infrastructure.
Here is what you need to know as this news story develops.
1. UTA0576 is a brand-new designation, part of a 2026 pattern of previously unknown actors emerging into named visibility
On October 13, 2026, cybersecurity firm Volexity disclosed the designation UTA0576 for a previously unknown threat actor it identified while investigating suspicious activity on an Ivanti Connect Secure (ICS) VPN appliance belonging to one of its monitoring customers. The investigation began on October 5, and the forensic reconstruction established that UTA0576 had been operating inside the environment since October 3, two days before Volexity’s team detected the activity. Threat intelligence firm Defused independently confirmed exploitation activity in the wild beginning October 1.
Volexity does not link UTA0576 to any known threat actor group, and has assessed with low confidence that UTA0576 is motivated by criminal rather than espionage objectives, based on the specific target profile and the post-exploitation activity observed. That assessment is explicitly low confidence because the operation was disrupted before UTA0576’s full objectives could be inferred from downstream activity.
UTA0576’s emergence fits a broader 2026 pattern of previously unknown actors graduating into named visibility, often alongside new zero-day disclosures against perimeter infrastructure. As SecurityWeek documented, Volexity has investigated multiple distinct unknown-actor operations across the year, and the frequency with which brand-new UTA designations are landing is itself a signal: the threat actor population visible to enterprise defenders is expanding faster than the attribution capacity of the industry can keep pace.
2. The three-flaw Ivanti zero-day chain, and Ivanti knew about part of it since June
UTA0576’s exploit chain combines three previously undisclosed vulnerabilities in Ivanti Connect Secure. The first two, tracked together as CVE-2026-104935, are an authentication bypass and a remote code execution flaw that let an unauthenticated remote attacker execute commands as the appliance’s cgi-server user. The third flaw, a privilege escalation vulnerability that elevates the attacker from cgi-server to root, is tracked separately and remains unpatched as of October 14, 2026.
CVE-2026-104935 carries a CVSS score of 8.6, and Ivanti rates it high-severity. The flaws affect ICS versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. The patched versions are 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2. Over 5,600 internet-exposed ICS appliances have been identified globally. CISA added CVE-2026-104935 to the KEV catalog on October 13 and ordered federal civilian agencies to apply the patch by October 16.
The timeline detail that defenders should take seriously is Ivanti’s own disclosure about what it knew and when. According to Cybernews, Ivanti became aware of the full exploit chain nearly two weeks before the October 13 public disclosure, and had initially discovered a portion of the vulnerability chain during internal security checks in June, roughly four months before the public advisory landed. That gap between vendor awareness and public disclosure is where UTA0576 operated.
3. UTA0576 deployed no malware, no web shell: Volexity explicitly compared the tradecraft to UTA0533’s SonicWall campaign
The absence of malware is the single most unusual feature of UTA0576’s tradecraft, and the one that makes this threat actor’s techniques worth security teams’ close attention. Where most VPN appliance intrusions in 2026 have followed the Citrix Bleed and Fortinet SSL-VPN playbook of deploying custom malware or web shells for persistence, UTA0576 did neither.
Instead, the group re-ran the entire exploit chain for every command it needed to execute. Each discrete action on the compromised appliance (file read, credential dump, log query, outbound command) was preceded by a fresh execution of the three-flaw chain. The design accomplishes two defensive objectives simultaneously: it leaves no persistent artifact for standard endpoint or appliance-telemetry detection to catch, and it leaves no stage-two implant that forensic investigators can retrieve and attribute. UTA0576 also deleted temporary files, removed its own entries from Ivanti debug and Linux audit logs, restored modified memory and configuration values to their pre-exploitation state, and used a renamed packet-capture utility to blend into legitimate administrative tooling. The group’s tradecraft specifically evaded Ivanti’s own Integrity Checker Tool, which is the standard appliance-level forensic baseline that most Ivanti customers rely on.
Volexity’s writeup makes a critical connection worth preserving in your organization’s threat intelligence feed. Volexity has explicitly compared UTA0576’s tradecraft to another newly named threat actor, UTA0533, which the firm identified in July 2026 as the operator exploiting SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances. UTA0533 began exploiting two SonicWall SMA zero-days, CVE-2026-15409 and CVE-2026-15410, as early as June 22, 2026, roughly three weeks before SonicWall’s public disclosure on July 14. Unlike UTA0576, UTA0533 did deploy malware on the compromised SonicWall appliances, including a webshell dubbed ORANGETAIL and a privilege-escalation binary called ROOTRUN. The architectural parallel is still what matters: multiple previously undisclosed vulnerabilities, chained together, against enterprise VPN appliances, with anti-forensic tradecraft that defeats appliance-native detection. Two distinct threat actors converging on the same category of infrastructure within three months, both named by Volexity, both exploiting multiple zero-days before vendor disclosure, is a pattern, not a coincidence.
4. The credential targets are the modern enterprise attack playbook: AD, LAPS, BitLocker, LDAP
Once UTA0576 established root access on the ICS appliance, the group’s post-exploitation activity focused immediately on credential harvesting rather than on broader reconnaissance or lateral movement. The specific credential types UTA0576 targeted are the ones that unlock downstream enterprise infrastructure most completely: stored LDAP domain credentials from the ICS appliance itself, Active Directory user and service account passwords, Local Administrator Password Solution (LAPS) passwords for domain-joined endpoints, and BitLocker recovery keys stored in Active Directory for workstation and laptop fleets. eSecurity Planet summarized the credential-theft focus as the practical operational signature of a group preparing to establish long-tenure access across the broader network.
UTA0576 then conducted password-spraying attacks against the Active Directory accounts it had enumerated during reconnaissance, which is the operational tradecraft of a group preparing to establish persistent access across the broader network rather than to extract a single payload and exit. The group also exfiltrated raw packet capture data from the ICS appliance, which is useful for off-appliance analysis of credentialing traffic that passes through the VPN. Volexity assesses with high confidence that UTA0576’s observed actions signal preparation for lateral movement and a broader compromise of the victim network, not a smash-and-grab intrusion.
5. LLM-assisted tradecraft is a 2026 pattern across many emerging actors, not just UTA0576
Volexity’s writeup explicitly flags the role of large language models in UTA0576’s tooling. The firm assesses with medium confidence that UTA0576 uses LLMs both for exploit development and for post-exploitation activity, based on structural characteristics of the exploit code and the patterns of operational scripting observed during the intrusion.
6. What enterprise security teams should do now
If your organization operates Ivanti Connect Secure in any configuration, three actions in priority order.
Within 24 hours: Confirm that every ICS appliance across your environment has been upgraded to a patched version (22.8R2.5, 25.1.3.0, 25.1.3.1, or 25.1.1.2). Assume that any appliance running an unpatched version between October 1 and October 13 may have been exploited by UTA0576 or another actor with knowledge of the chain, and treat those appliances as compromised until forensic investigation proves otherwise. The absence of a web shell or malware on the device does not rule out intrusion, and standard appliance scans will not detect UTA0576’s tradecraft.
Within one week: Rotate every credential type that UTA0576 is known to have targeted. That includes LDAP domain credentials stored on the ICS appliance, Active Directory passwords for accounts that may have been enumerated through the appliance, LAPS passwords across the domain-joined endpoint fleet, and BitLocker recovery keys. Review Active Directory authentication logs from October 1 forward for password-spraying patterns and anomalous service-account activity. If your organization operates SonicWall Secure Mobile Access appliances in parallel with Ivanti Connect Secure, extend the same credential rotation and forensic review to those appliances given UTA0533’s exploitation of a parallel zero-day chain against the SonicWall SMA product line earlier this year.
Structurally: Treat VPN appliances and perimeter access devices as high-value credential stores that attackers will specifically pursue, not as passive network plumbing. CybelAngel’s Attack Surface Management identifies the externally reachable Ivanti Connect Secure and SonicWall SMA instances in your organization and across your supply chain, the way an attacker would discover them. Credential Intelligence surfaces the Active Directory credentials, LAPS passwords, and BitLocker recovery keys that appear on dark web and underground sources when a VPN compromise cascades into broader credential exposure. Dark Web Monitoring tracks the underground markets where emerging threat actors like UTA0576 and UTA0533 publish stolen credentials and session cookies for sale to downstream operators.
FAQs
UTA0576 is a previously unknown threat actor designation created by Volexity on October 13, 2026, during the firm’s forensic investigation of a chained three zero-day exploitation of an Ivanti Connect Secure VPN appliance. Volexity does not link UTA0576 to any known threat actor group and assesses the actor’s motivation as criminal rather than espionage with only low confidence.
UTA0576 chained three zero-day vulnerabilities in Ivanti Connect Secure. The first two, tracked together as CVE-2026-104935, are an authentication bypass and remote code execution flaw. The third is a privilege escalation vulnerability that elevates the attacker from the cgi-server user to root. Only CVE-2026-104935 has been patched. The privilege escalation flaw remains unpatched.
UTA0533 is a separate threat actor Volexity identified in July 2026, which began exploiting two SonicWall Secure Mobile Access (SMA) zero-days (CVE-2026-15409 and CVE-2026-15410) on June 22, 2026. Volexity does not link the two actors but has explicitly compared UTA0576’s tradecraft to UTA0533’s, noting that both actors chained multiple undisclosed vulnerabilities against enterprise VPN appliances. Unlike UTA0576, UTA0533 did deploy custom malware on the compromised SonicWall appliances, including the ORANGETAIL webshell and the ROOTRUN privilege-escalation binary.
UTA0576 deployed no malware and no web shell on the compromised appliance. The group re-ran the entire three-flaw exploit chain for every command it needed to execute, which left no persistent artifact for standard detection to catch. UTA0576 also deleted log entries, restored modified configurations, used renamed legitimate utilities for evasion, and evaded Ivanti’s own Integrity Checker Tool. Volexity assesses with medium confidence that UTA0576 uses large language models for exploit development and post-exploitation activity.
Standard file-system scans and web-shell detection will not reliably identify UTA0576 activity. Detection requires network forensics for anomalous outbound traffic to IP 108.165.147.64 or similar short-rental VPS infrastructure, memory forensics on ICS appliances that were running unpatched versions during October 1 through 13, and authentication-log analysis for password-spraying patterns against Active Directory accounts enumerated through compromised ICS appliances.
About the author
