Ivanti customers should review the blog released by Mandiant outlining additional TTPs and observations regarding the unsuccessful attempt to achieve persistence through factory reset that they observed. Update: CISA, and other government agencies, have released a joint advisory on 29 February compiling prior research, including the findings released by Ivanti and Mandiant on 27 February and a potential persistence technique developed in CISA's technical lab. It is important to note that this lab-based finding has not been observed by CISA, Ivanti or Mandiant in the wild, and based on the evidence presented and further analysis by our team, we believe that if a threat actor were to attempt this remotely they would lose connection to Ivanti Connect Secure, and not gain persistence in a live customer environment.