Loading story…
ANSSI reported that a threat cluster it tracks as Houken exploited three Ivanti Cloud Service Appliance zero-days—CVE-2024-8190, CVE-2024-8963, and CVE-2024-9380—to compromise French organizations in government, telecommunications, media, finance, and transport. The intrusions focused on stealing credentials and maintaining access through PHP webshells, modified legitimate PHP files, and in at least one case a Linux rootkit installed on an internet-facing Ivanti CSA device. ANSSI said the actor used a blend of commercial VPNs, VPS infrastructure, Tor exit nodes, and residential or mobile IP space, and assessed with moderate confidence that Houken overlaps with UNC5174, a China-nexus intrusion set linked to initial access brokerage.
Follow-on investigations showed that after the zero-day exploitation, the attackers relied heavily on commodity open-source tooling for persistence and lateral movement. Synacktiv observed use of the suo5 HTTP proxy webshell to tunnel traffic through exposed servers, the iox tunneling tool for port forwarding and persistence, and a modified atexec-pro.py script to execute code remotely through Windows Task Scheduler. The findings indicate that while the initial compromise depended on advanced Ivanti exploitation, later activity created practical detection opportunities through recognizable post-exploitation tradecraft, including webshell deployment, tunneling behavior, and suspicious PowerShell spawned by task-based remote execution.
See which actors are running it and whether you're in range.
8 events from the most recent confirmed update back to the earliest known activity.
On May 12, 2025, Synacktiv published analysis of the open-source post-exploitation tools used in Ivanti CSA intrusions, including suo5, iox, and a modified atexec-pro.py. The publication also released YARA and Sigma detection rules for these tools.
ANSSI said the most recent activity related to the Houken Ivanti CSA campaign was observed at the end of November 2024. In some French cases, the compromises had progressed from the internet-facing appliance into internal information systems.
ANSSI observed one NordVPN IP address used in two separate incidents on September 14, 2024, indicating infrastructure reuse by the attacker. The campaign used mixed infrastructure including commercial VPNs, VPS servers, Tor exit nodes, and residential or mobile IP space.
Threat actors were reported to be chaining Ivanti Cloud Services Appliance vulnerabilities as early as September 9, 2024, before Ivanti had publicly released advisories or patches. ANSSI later said the vulnerabilities CVE-2024-8190, CVE-2024-8963, and CVE-2024-9380 were exploited as zero-days.
During post-compromise activity in the Ivanti CSA intrusions, attackers used a modified Impacket-based script named atexec-pro.py to execute commands on an Active Directory domain controller from another internal host. Synacktiv highlighted this as part of the lateral movement toolset seen in the cases it investigated.
In incidents that began with exploitation of vulnerable Ivanti CSA appliances in September and October 2024, attackers moved to internet-facing Microsoft Exchange servers and deployed the suo5 HTTP proxy webshell at OutlookEN.aspx. They also deployed the iox tunneling tool on the Ivanti CSA appliance to maintain access after patches were applied.
Ivanti published multiple security advisories in September and October 2024 for security policy bypass and remote code execution vulnerabilities affecting Cloud Services Appliance. These advisories followed exploitation activity that had already begun.
In September 2024, ANSSI observed a campaign exploiting Ivanti CSA devices to gain initial access to French organizations in government, telecommunications, media, finance, and transport. ANSSI named the intrusion set behind the activity Houken.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited Ivanti Connect Secure zero-days **`CVE-2023-46805`** and **`CVE-2024-21887`** to gain initial access and launch extensive follow-on activity, including in MITRE's NERVE research network. MITRE said the intrusion overlapped with Mandiant reporting on the China-nexus espionage actor **UNC5221** and began with exploitation of the Ivanti appliance, deployment of the **ROOTROT** web shell, MFA bypass, and use of HTML5-based RDP access. The attackers then profiled VMware infrastructure, used compromised administrative credentials, manipulated virtual machines, and staged data for exfiltration through the Ivanti help site before moving data out through command-and-control infrastructure.
Aug 15, 2026
A suspected China-linked espionage actor has been actively exploiting **CVE-2025-22457**, a critical stack-based/buffer overflow flaw in **Ivanti Connect Secure** that enables unauthenticated remote code execution and full device compromise. Ivanti and Mandiant said exploitation began in mid-March against vulnerable **Ivanti Connect Secure** appliances, with attacks also affecting **Pulse Connect Secure** and prompting security updates for **Ivanti Policy Secure** and **ZTA Gateways**. The flaw carries a **CVSS 9.0** rating and affects Ivanti Connect Secure `22.7R2.5` and earlier, while the corrected version was shipped in `22.7R2.6`. Mandiant attributed the activity and deployment of the **SPAWN** malware ecosystem to **UNC5221**, a suspected China-nexus threat actor known for targeting edge devices with zero-days. Post-compromise activity included a shell-script dropper that installs two newly identified malware families, **TRAILBLAZE** and **BRUSHFIRE**, while operators also attempted to evade detection by tampering with Ivanti's Integrity Checker Tool and routing activity through compromised **Cyberoam**, **QNAP**, and **ASUS** devices. Ivanti and defenders urged organizations to immediately upgrade supported systems, migrate away from end-of-support **Pulse Connect Secure**, and monitor for indicators such as web-process core dumps, Integrity Checker Tool state dumps, and anomalous client TLS certificates.
Jul 24, 2026
Cisco Talos reported multiple intrusions against **high-value North American critical infrastructure** organizations attributed to **UAT-8837**, assessed with *medium confidence* as a **China-nexus APT** focused on obtaining initial access. Talos said the actor gained entry via **compromised credentials** and **exploitation of vulnerable servers**, then conducted hands-on-keyboard activity to harvest credentials and environment data (including **security configurations** and **Active Directory** information) to establish redundant access paths. Observed post-compromise tooling included **Earthworm** (used to create reverse tunnels and expose internal endpoints), **SharpHound**, **DWAgent**, and **Certipy**, alongside common discovery commands (e.g., `tasklist /svc`, `netstat -aon -p TCP`, `whoami`). Talos linked UAT-8837 activity to exploitation of **CVE-2025-53690**, described as a **ViewState deserialization zero-day** affecting **Sitecore** products, noting that the overlap in tooling/infrastructure with other observed exploitation suggests the actor **may have access to zero-day exploits**. Reporting also highlighted that the vulnerability had previously been emphasized by U.S. federal cybersecurity authorities with a mandated patch timeline for federal civilian agencies, and that prior third-party analysis of incidents involving the same bug described similar post-exploitation tooling—reinforcing the assessment that this vulnerability has been operationalized in real intrusions against critical infrastructure targets.
Jun 29, 2026