Loading story…
A suspected China-linked espionage actor has been actively exploiting CVE-2025-22457, a critical stack-based/buffer overflow flaw in Ivanti Connect Secure that enables unauthenticated remote code execution and full device compromise. Ivanti and Mandiant said exploitation began in mid-March against vulnerable Ivanti Connect Secure appliances, with attacks also affecting Pulse Connect Secure and prompting security updates for Ivanti Policy Secure and ZTA Gateways. The flaw carries a CVSS 9.0 rating and affects Ivanti Connect Secure 22.7R2.5 and earlier, while the corrected version was shipped in 22.7R2.6.
Mandiant attributed the activity and deployment of the SPAWN malware ecosystem to UNC5221, a suspected China-nexus threat actor known for targeting edge devices with zero-days. Post-compromise activity included a shell-script dropper that installs two newly identified malware families, TRAILBLAZE and BRUSHFIRE, while operators also attempted to evade detection by tampering with Ivanti's Integrity Checker Tool and routing activity through compromised Cyberoam, QNAP, and ASUS devices. Ivanti and defenders urged organizations to immediately upgrade supported systems, migrate away from end-of-support Pulse Connect Secure, and monitor for indicators such as web-process core dumps, Integrity Checker Tool state dumps, and anomalous client TLS certificates.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Ivanti released security updates for Ivanti Connect Secure, Ivanti Policy Secure, and ZTA Gateways to address CVE-2025-22457. The advisory also said attacks had targeted Ivanti Connect Secure and the end-of-support Pulse Connect Secure product.
Mandiant and Ivanti observed active exploitation of CVE-2025-22457 beginning in mid-March 2025 against Ivanti Connect Secure appliances. The activity was later linked to post-exploitation malware deployment including TRAILBLAZE, BRUSHFIRE, and the SPAWN ecosystem.
Google Threat Intelligence Group assessed that UNC5221, a suspected China-nexus espionage actor, was responsible for exploiting CVE-2025-22457 and deploying SPAWN malware on affected edge devices. The report also described evasion tactics including tampering with Ivanti's Integrity Checker Tool and use of an obfuscation network of compromised devices.
Ivanti publicly disclosed CVE-2025-22457, a critical buffer overflow vulnerability affecting Ivanti Connect Secure, on April 3, 2025. The disclosure noted active exploitation, and guidance was issued to upgrade supported products immediately.
Ivanti Connect Secure version 22.7R2.6 was released with a fix for CVE-2025-22457 before the flaw was publicly disclosed. The issue was initially assessed as a low-risk denial-of-service condition rather than remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcecloud.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mandiant reported that the suspected China-linked espionage actor **UNC5221** actively exploited **`CVE-2025-22457`**, a critical buffer overflow in **Ivanti Connect Secure** VPN appliances, to achieve remote code execution on devices running **22.7R2.5 and earlier**. The activity reportedly began by at least mid-March, with Mandiant assessing that the attackers likely identified the opportunity by reverse-engineering a February patch for the vulnerability. After gaining access, UNC5221 deployed two newly identified malware families, **TRAILBLAZE** and **BRUSHFIRE**, alongside components from the previously documented **SPAWN** malware ecosystem. Mandiant said the intrusion set reflects the group’s continued emphasis on compromising internet-facing edge devices and warned organizations to upgrade affected Ivanti Connect Secure appliances to **22.7R2.6 or later** immediately.
Jun 29, 2026
Ivanti disclosed security updates for **Ivanti Connect Secure**, **Ivanti Policy Secure**, and **Ivanti Neurons for ZTA gateways** to address `CVE-2025-0282` and `CVE-2025-0283`. The most serious flaw, `CVE-2025-0282`, is a **critical stack-based buffer overflow** with a CVSS score of **9.0** that enables **unauthenticated remote code execution** and has been actively exploited against Ivanti Connect Secure appliances. The second issue, `CVE-2025-0283`, is a **high-severity** flaw with a CVSS score of **7.0** that can allow a **local authenticated attacker to escalate privileges**. According to CSIRT.SK, citing JPCERT/CC, attackers have used `CVE-2025-0282` to deploy the **SPAWNCHIMERA** malware framework, which combines **SPAWNANT**, **SPAWNMOLE**, and **SPAWNNAIL** and includes functionality intended to prevent reinfection by competing threat actors. Ivanti urged customers to **urgently patch affected systems**, verify appliance integrity with the **Integrity Checker Tool**, and consider performing a **factory reset before patching** if compromise is suspected.
Jul 24, 2026
Mandiant and national defenders reported active exploitation of two zero-day flaws in **Ivanti Connect Secure** and **Ivanti Policy Secure** gateways, identified as `CVE-2023-46805` and `CVE-2024-21887`. The bugs allow an authentication bypass and command injection, and were used together in intrusions targeting internet-facing VPN appliances. Reporting linked the activity to a suspected China-nexus threat actor targeting Ivanti devices as an initial access vector. Attackers used the exploit chain to steal configuration data, modify files, establish a remote tunnel from compromised VPN devices, evade integrity checks, and deploy a backdoor by altering a legitimate CGI file. Affected versions included **9.x** and **22.x** releases of the Ivanti products, and Ivanti issued a mitigation file, `mitigation.release.20240107.1.xml`, as a recommended defensive measure while organizations worked to contain compromised gateways and assess follow-on access.
Jul 24, 2026