Loading story…
Mandiant and national defenders reported active exploitation of two zero-day flaws in Ivanti Connect Secure and Ivanti Policy Secure gateways, identified as CVE-2023-46805 and CVE-2024-21887. The bugs allow an authentication bypass and command injection, and were used together in intrusions targeting internet-facing VPN appliances. Reporting linked the activity to a suspected China-nexus threat actor targeting Ivanti devices as an initial access vector.
Attackers used the exploit chain to steal configuration data, modify files, establish a remote tunnel from compromised VPN devices, evade integrity checks, and deploy a backdoor by altering a legitimate CGI file. Affected versions included 9.x and 22.x releases of the Ivanti products, and Ivanti issued a mitigation file, mitigation.release.20240107.1.xml, as a recommended defensive measure while organizations worked to contain compromised gateways and assess follow-on access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Ivanti provided the mitigation file mitigation.release.20240107.1.xml as a recommended defensive measure for affected Ivanti Connect Secure and Policy Secure versions 9.x and 22.x. The mitigation was offered in response to the active exploitation of the two zero-days.
The exploitation activity described in the reporting was attributed to a China-linked threat actor. This attribution accompanied reporting on the zero-day exploitation against Ivanti devices.
Ivanti disclosed CVE-2023-46805, an authentication bypass, and CVE-2024-21887, a command injection flaw, affecting Ivanti Connect Secure and Ivanti Policy Secure gateways. The disclosure stated the vulnerabilities were being actively exploited in the wild.
Attackers were reported to chain the two Ivanti vulnerabilities to steal configuration data, modify files, create a remote tunnel from VPN devices, evade integrity checks, and implant a backdoor in a legitimate CGI file. Mandiant described the activity as suspected APT exploitation targeting Ivanti Connect Secure VPN appliances.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
China-nexus threat actors exploited remote code execution flaws in **Ivanti Connect Secure** VPN appliances to breach multiple organizations, according to TeamT5. The reporting links intrusions to abuse of Ivanti vulnerabilities including `CVE-2025-22457`, and follows earlier attention on `CVE-2025-0282`, a pre-authentication RCE tied to a TLS stack overflow in the product's IFT component. The activity shows continued attacker focus on internet-facing Ivanti gateways as an initial access path into enterprise environments. Public exploit development accompanied the disclosures, with GitHub repositories publishing proof-of-concept code and scanner tooling for both `CVE-2025-22457` and `CVE-2025-0282`. The availability of PoCs lowers the barrier for follow-on exploitation and increases pressure on defenders to patch exposed Ivanti Connect Secure systems, hunt for signs of compromise on VPN appliances, and review access originating from those devices into internal networks.
Jul 12, 2026
A suspected China-linked espionage actor has been actively exploiting **CVE-2025-22457**, a critical stack-based/buffer overflow flaw in **Ivanti Connect Secure** that enables unauthenticated remote code execution and full device compromise. Ivanti and Mandiant said exploitation began in mid-March against vulnerable **Ivanti Connect Secure** appliances, with attacks also affecting **Pulse Connect Secure** and prompting security updates for **Ivanti Policy Secure** and **ZTA Gateways**. The flaw carries a **CVSS 9.0** rating and affects Ivanti Connect Secure `22.7R2.5` and earlier, while the corrected version was shipped in `22.7R2.6`. Mandiant attributed the activity and deployment of the **SPAWN** malware ecosystem to **UNC5221**, a suspected China-nexus threat actor known for targeting edge devices with zero-days. Post-compromise activity included a shell-script dropper that installs two newly identified malware families, **TRAILBLAZE** and **BRUSHFIRE**, while operators also attempted to evade detection by tampering with Ivanti's Integrity Checker Tool and routing activity through compromised **Cyberoam**, **QNAP**, and **ASUS** devices. Ivanti and defenders urged organizations to immediately upgrade supported systems, migrate away from end-of-support **Pulse Connect Secure**, and monitor for indicators such as web-process core dumps, Integrity Checker Tool state dumps, and anomalous client TLS certificates.
Jul 24, 2026
Ivanti disclosed security updates for **Ivanti Connect Secure**, **Ivanti Policy Secure**, and **Ivanti Neurons for ZTA gateways** to address `CVE-2025-0282` and `CVE-2025-0283`. The most serious flaw, `CVE-2025-0282`, is a **critical stack-based buffer overflow** with a CVSS score of **9.0** that enables **unauthenticated remote code execution** and has been actively exploited against Ivanti Connect Secure appliances. The second issue, `CVE-2025-0283`, is a **high-severity** flaw with a CVSS score of **7.0** that can allow a **local authenticated attacker to escalate privileges**. According to CSIRT.SK, citing JPCERT/CC, attackers have used `CVE-2025-0282` to deploy the **SPAWNCHIMERA** malware framework, which combines **SPAWNANT**, **SPAWNMOLE**, and **SPAWNNAIL** and includes functionality intended to prevent reinfection by competing threat actors. Ivanti urged customers to **urgently patch affected systems**, verify appliance integrity with the **Integrity Checker Tool**, and consider performing a **factory reset before patching** if compromise is suspected.
Jul 24, 2026