Suspected China-Nexus threat actor actively exploiting critical Ivanti Connect Secure flaw
Take action: If you are using Connect Secure, Policy Secure, ZTA Gateways or Pulse Connect, time for an urgent patch. This flaw is actively exploited. No real mitigations, most of these systems are exposed to the public by default. Start patching NOW!
Learn More
On April 3, 2025, Ivanti disclosed a critical security vulnerability affecting their Connect Secure VPN appliances. This vulnerability is actively being exploited by UNC5221, a suspected China-nexus espionage actor with a history of targeting edge devices since 2023.
The flaw is tracked as CVE-2025-22457 (CVSS score 9.0), a buffer overflow vulnerability that can lead to remote code execution. The vulnerability affects:
- Ivanti Connect Secure (ICS) version 22.7R2.5 and earlier
- Ivanti Policy Secure (patch in development)
- Ivanti ZTA Gateways (patch in development)
- End-of-life Pulse Connect Secure 9.1x appliances
A patch for this vulnerability was released in ICS 22.7R2.6 on February 11, 2025, but was initially believed to be a low-risk denial-of-service vulnerability. The threat actor studied the patch and uncovered a way to exploit the vulnerability in earlier versions to achieve remote code execution.
Evidence of active exploitation dates back to mid-March 2025, with Ivanti confirming that a "limited number of customers" using vulnerable versions have been compromised. Following successful exploitation, researchers observed the deployment of several malware families:
- TRAILBLAZE: A newly identified in-memory dropper designed to be minimal and use raw syscalls
- BRUSHFIRE: A newly identified passive backdoor that acts as an SSL_read hook
- SPAWN ecosystem: Previously reported malware attributed to UNC5221, including:
- SPAWNSLOTH: A log tampering component targeting the dslogserver process
- SPAWNSNARE: A utility for extracting and encrypting the Linux kernel image
- SPAWNWAVE: An evolved version of SPAWNANT combining capabilities from other SPAWN malware
Google Threat Intelligence Group (GTIG) attributes this activity to UNC5221, a suspected China-nexus espionage actor. UNC5221 has targeted a wide range of countries and sectors, leveraging an extensive set of tooling from passive backdoors to trojanized legitimate components on various edge appliances. They've also been observed using an obfuscation network of compromised Cyberoam appliances, QNAP devices, and ASUS routers to mask their source during operations.
Mandiant and Ivanti recommend organizations:
- Immediately apply the available patch by upgrading ICS appliances to version 22.7R2.6 or later
- Use the external and internal Integrity Checker Tool (ICT) and contact Ivanti Support if suspicious activity is identified
