Loading story…
SentinelLABS disrupted multiple China-nexus cyberespionage campaigns between June 2024 and March 2025 targeting SentinelOne, a South Asian government entity, a European media organization, and more than 70 other victims. The ShadowPad and PurpleHaze clusters used chained zero-days in edge appliances, including CVE-2024-8963 and CVE-2024-8190, alongside ShadowPad malware protected by ScatterBrain/ScatterBee obfuscation, the Go-based GOREshell reverse-SSH backdoor, Nimbo-C2, operational relay box networks, and log removal. SentinelOne reported that it was not compromised.
A joint Tenable-SentinelOne review shows that this activity reflects a broader cross-actor pattern: 93 CVE-to-actor attribution pairs across 82 vulnerabilities converged on all seven identified edge-device vendors, despite only 21% overlap in the CVEs tracked independently. Twelve flaws have confirmed exploitation by multiple China-, Russia-, DPRK-, or Iran-linked groups and ransomware operators. F5, Citrix, and Ivanti EPMM and Connect Secure deployments face recurring exposure and exploitation; organizations should prioritize edge-device patching, disable unnecessary features, continuously monitor remote-access systems, and use segmentation and other defense-in-depth controls to limit lateral movement after a breach.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
SentinelLABS identified and disrupted a ShadowPad intrusion at an IT services and logistics company that managed hardware for SentinelOne employees. SentinelOne reported no resulting compromise of its own assets.
A China-linked actor exploited CVE-2024-8963 and CVE-2024-8190 against an Ivanti Cloud Services Appliance and collected SSH keys and other stored credentials. The activity was associated with the PurpleHaze cluster and UNC5174-linked access brokering.
SentinelLABS observed and countered a PurpleHaze reconnaissance operation targeting SentinelOne. SentinelOne found no evidence that its infrastructure, software, or hardware assets were compromised.
ShadowPad and PurpleHaze activity clusters conducted intrusions against more than 70 organizations across manufacturing, government, finance, telecommunications, and research, including a South Asian government entity and a European media organization. SentinelLABS attributed the activity with high confidence to China-nexus actors, with links to APT15 and UNC5174.
Tenable and SentinelOne analyzed 93 CVE-actor attribution pairs involving approximately 39 threat actors and identified 82 distinct CVEs. The analysis found 12 vulnerabilities with confirmed exploitation by multiple state-linked or criminal actor nexuses, including China-linked PurpleHaze and Iran-linked Fox Kitten exploitation of CVE-2024-24919.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 53 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors exploited two zero-day vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), tracked as **CVE-2026-1281** and **CVE-2026-1340**. The incidents add to recurring exploitation of Ivanti EPMM and Connect Secure appliances, which remain attractive entry points for both state-sponsored and financially motivated operators. A joint Tenable and SentinelOne analysis found that disparate actor groups converge on the same edge and remote-access vendors even when they use different vulnerabilities: its dataset covered 82 CVEs and 93 actor-attribution pairs, with only 21% CVE overlap but 79% vendor overlap. Organizations should prioritize patching internet-facing Ivanti and other edge devices, reduce exposed attack surface, enforce edge-specific remediation SLAs, and use endpoint controls to limit post-compromise lateral movement.
Aug 26, 2026
A suspected China-linked espionage actor has been actively exploiting **CVE-2025-22457**, a critical stack-based/buffer overflow flaw in **Ivanti Connect Secure** that enables unauthenticated remote code execution and full device compromise. Ivanti and Mandiant said exploitation began in mid-March against vulnerable **Ivanti Connect Secure** appliances, with attacks also affecting **Pulse Connect Secure** and prompting security updates for **Ivanti Policy Secure** and **ZTA Gateways**. The flaw carries a **CVSS 9.0** rating and affects Ivanti Connect Secure `22.7R2.5` and earlier, while the corrected version was shipped in `22.7R2.6`. Mandiant attributed the activity and deployment of the **SPAWN** malware ecosystem to **UNC5221**, a suspected China-nexus threat actor known for targeting edge devices with zero-days. Post-compromise activity included a shell-script dropper that installs two newly identified malware families, **TRAILBLAZE** and **BRUSHFIRE**, while operators also attempted to evade detection by tampering with Ivanti's Integrity Checker Tool and routing activity through compromised **Cyberoam**, **QNAP**, and **ASUS** devices. Ivanti and defenders urged organizations to immediately upgrade supported systems, migrate away from end-of-support **Pulse Connect Secure**, and monitor for indicators such as web-process core dumps, Integrity Checker Tool state dumps, and anomalous client TLS certificates.
Jul 24, 2026
Trend Micro and TrendAI reported that China-aligned espionage groups collaborated by passing live access to already-compromised networks between intrusion sets, a model Trend calls **"Premier Pass-as-a-Service."** In one cited case, **Earth Estries** breached a Southeast Asian government environment, deployed **CrowDoor** and related tooling, and then enabled follow-on activity tied to **Earth Naga**—also tracked as **Flax Typhoon**, **RedJuliett**, or **Ethereal Panda**—including **ShadowPad** infrastructure. The reporting says this approach differs from traditional initial access brokerage because downstream operators appear to receive direct access to victim assets rather than just stolen credentials or footholds. The activity aligns with separate reporting that **RedJuliett** intensified cyber espionage against Taiwanese organizations through exploitation of internet-facing network perimeter devices, while Trend Micro described **Earth Estries** as conducting long-term intrusions across government, telecommunications, and information service providers in APAC, Taiwan, and NATO countries. Researchers said the cooperative model can place multiple China-linked actors in the same intrusion chain or even the same process flow, complicating attribution and incident response, and they highlighted exploitation of **Citrix** devices including `CVE-2025-5777` among the techniques used to gain or extend access.
Aug 21, 2026