The vendor said the memory-corruption defect was exploited to target specific people, but it did not describe the objectives of the attack.

Shadowserver scans have identified 86 compromised instances, and researchers warn multiple threat groups are involved.

Limited attacks occurred prior to Ivanti’s disclosure, followed by mass exploitation by multiple threat groups. More than 1,400 potentially vulnerable instances remain exposed.

For 20 years, tech has moved fast and broken things. The result: a cybersecurity crisis built on rushed code and vulnerable software. It's time to replace speed-at-all-costs…

Cisco has yet to release a patch for the actively exploited vulnerability, and attacks have been underway since at least late November.

Microsoft closed out the year with 1,139 total defects patched, making it the second-largest year in volume behind 2020, according to Trend Micro.

The Ivy League school said it was one of almost 100 organizations hit by the simultaneous attacks in August.

The newspaper said a “bad actor” contacted the company in late September, prompting an investigation that nearly a month later confirmed the extent of compromise.

The vendors disclosed and patched the defects last summer, but not before advanced attackers exploited the vulnerabilities to likely gain prolonged access for espionage, according to Amazon.

Researchers warn that although exploitation of the zero-day is complex, a functional exploit exists in the wild.