SPAWN

SPAWN is a malware ecosystem/suite associated with China-nexus cyber espionage activity and attributed in reporting to clusters including UNC5221; separate reporting also states UNC5337 exploited Ivanti Connect Secure CVE-2025-0282 as a zero-day to deliver the SPAWN ecosystem. It has been observed in intrusions involving Ivanti Connect Secure edge devices, including exploitation of CVE-2025-22457 and CVE-2025-0282. Reporting describes SPAWN as a previously reported malware suite used in operations against compromised Ivanti appliances, with TeamT5 linking intrusions across at least 170 Ivanti Connect Secure devices in 25 regions to the SPAWN suite. Known components and related variants mentioned in the content include SPAWNSLOTH, a log-tampering component tied to the SPAWNSNAIL backdoor that targets dslogserver to disable local logging and remote syslog forwarding; SPAWNSNARE, a Linux utility written in C that extracts an uncompressed Linux kernel image (vmlinux) and encrypts it using AES without command-line tools; SPAWNWAVE, an evolved version of SPAWNANT that combines capabilities from other SPAWN components and overlaps with SPAWNCHIMERA and RESURGE; and additional SPAWN-related malware including TextDoor and DebtTheft. Updated SPAWN variants SPAWNCHIMERA and RESURGE were also reported by JPCERT/CC and CISA. The malware suite is tied to post-compromise activity on edge devices and has been deployed alongside other malware families such as TRAILBLAZE and BRUSHFIRE in UNC5221 operations. High-confidence targeting context in the content centers on edge/network appliances, especially Ivanti Connect Secure devices, with regional victim concentrations reported in Japan, Taiwan, South Korea, and the United States.