SpawnSloth
SPAWNSLOTH is a SPAWN malware ecosystem component used for log tampering and log wiping on compromised Ivanti Connect Secure devices. It has been observed as a variant named liblogblock.so contained within the RESURGE implant, where its purpose is to tamper with Ivanti device logs to hide malicious activity and erase evidence of intrusion. Reporting also describes SPAWNSLOTH as tied to the SPAWNSNAIL backdoor and targeting the dslogserver process to disable both local logging and remote syslog forwarding. The malware has been associated with exploitation of Ivanti vulnerabilities including CVE-2025-0282, and broader SPAWN ecosystem activity observed after exploitation of CVE-2025-22457. The activity has been linked by Mandiant/Google Threat Intelligence Group and other reporting to the China-linked threat actor UNC5221, with related clustering also referencing UNC5337. It has been used in campaigns targeting Ivanti Connect Secure VPN appliances across multiple sectors and countries. A known file name associated with a SPAWNSLOTH variant is liblogblock.so.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
On April 3, 2025, Ivanti disclosed a critical vulnerability, CVE-2025-22457, affecting Ivanti Connect Secure (ICS) VPN appliances version 22.7R2.5 and earlier. The flaw, initially underestimated as a denial-of-service risk, was later found to be a buffer overflow that allows remote code execution. Mandiant observed exploitation beginning in mid-March 2025... | The actor also used other SPAWN components such as SPAWNSLOTH (log tampering), SPAWNSNARE (kernel image extraction and encryption), and SPAWNWAVE (an evolved implant utility).
Researchers believe a China-linked threat actor, UNC5221, exploited the CVE-2025-0282 vulnerability as a zero-day since mid-December 2024.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
It includes multiple modules with diverse capabilities: SPAWNSLOTH: Log wiper
It includes multiple modules with diverse capabilities: SPAWNSLOTH: Log wiper
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique"deployment of ... malware families ... TRAILBLAZE ... BRUSHFIRE ... deployment of the previously reported SPAWN ecosystem of malware"
Initial Access
1 technique"...threat actors exploited Ivanti CVE-2025-0282 for initial access."
Execution
1 technique"The main attack vector is CVE-2025-0282, a stack-based buffer overflow vulnerability that affects Ivanti Connect Secure, Policy Secure, and ZTA Gateways."
Stealth
2 techniquesOther
1 techniqueIOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware/tooling family referenced here as a variant used to tamper with logs on compromised systems to hinder detection and incident response.
Referenced as a malware/tool variant (liblogblock.so) used alongside RESURGE to tamper with logs on compromised Ivanti Connect Secure devices, supporting stealth and defense evasion.
A SPAWN-family log-tampering utility used to erase or manipulate Ivanti device logs to remove evidence of compromise and hinder incident response/forensics.
Log-tampering component/variant embedded within the RESURGE sample, used to interfere with Ivanti device logging.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.