⠠⠵ avuko<p><span class="h-card" translate="no"><a href="https://infosec.exchange/@otmar" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>otmar</span></a></span> Can we please advise people to not turn their Ivanti Connect Secure (ICS) Version 9.x off? </p><p>It is better to disconnect such devices from all networks and get your IR/CERT/SOC to take an HD image and memory dump*. Then turn it off.</p><p>*) Contact your Ivanti rep to tell you how, because of course they've put all info behind their customer login.</p><p><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/IvantiConnectSecure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>IvantiConnectSecure</span></a> <a href="https://infosec.exchange/tags/ICS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ICS</span></a></p>