Houken seeking a path by living on the edge with zero-days

ANSSI describes the Houken intrusion set that opportunistically exploited multiple Ivanti CSA zero-days in Sept 2024 to obtain initial access across government, telecom, media, finance and transport sectors, deploying PHP webshells, public offensive tools and a novel kernel rootkit, documenting IoCs and linking the activity to UNC5174 and potential access-brokering for state-aligned intelligence collection.