Loading story…
Mandiant reported that the suspected China-linked espionage actor UNC5221 actively exploited CVE-2025-22457, a critical buffer overflow in Ivanti Connect Secure VPN appliances, to achieve remote code execution on devices running 22.7R2.5 and earlier. The activity reportedly began by at least mid-March, with Mandiant assessing that the attackers likely identified the opportunity by reverse-engineering a February patch for the vulnerability.
After gaining access, UNC5221 deployed two newly identified malware families, TRAILBLAZE and BRUSHFIRE, alongside components from the previously documented SPAWN malware ecosystem. Mandiant said the intrusion set reflects the group’s continued emphasis on compromising internet-facing edge devices and warned organizations to upgrade affected Ivanti Connect Secure appliances to 22.7R2.6 or later immediately.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On April 3, 2025, Mandiant disclosed active exploitation of CVE-2025-22457 and attributed the activity to UNC5221. The report urged organizations to upgrade Ivanti Connect Secure appliances to version 22.7R2.6 or later immediately.
During post-compromise operations in the Ivanti campaign, UNC5221 deployed the newly identified malware families TRAILBLAZE and BRUSHFIRE along with components from the previously reported SPAWN malware ecosystem. These tools were used after successful exploitation of affected appliances.
Since at least mid-March 2025, the suspected China-nexus espionage actor UNC5221 has used CVE-2025-22457, a critical buffer overflow in Ivanti Connect Secure 22.7R2.5 and earlier, for remote code execution. The activity targeted Ivanti edge devices as part of an espionage campaign.
Ivanti released a patch in February 2025 that Mandiant later assessed UNC5221 likely analyzed to identify the n-day vulnerability CVE-2025-22457. This patch release is described as the probable starting point for the actor's discovery of the flaw.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
China-nexus threat actors exploited remote code execution flaws in **Ivanti Connect Secure** VPN appliances to breach multiple organizations, according to TeamT5. The reporting links intrusions to abuse of Ivanti vulnerabilities including `CVE-2025-22457`, and follows earlier attention on `CVE-2025-0282`, a pre-authentication RCE tied to a TLS stack overflow in the product's IFT component. The activity shows continued attacker focus on internet-facing Ivanti gateways as an initial access path into enterprise environments. Public exploit development accompanied the disclosures, with GitHub repositories publishing proof-of-concept code and scanner tooling for both `CVE-2025-22457` and `CVE-2025-0282`. The availability of PoCs lowers the barrier for follow-on exploitation and increases pressure on defenders to patch exposed Ivanti Connect Secure systems, hunt for signs of compromise on VPN appliances, and review access originating from those devices into internal networks.
Jul 11, 2026
Ivanti disclosed multiple critical vulnerabilities affecting **Ivanti Connect Secure**, **Ivanti Policy Secure**, and **Ivanti Neurons for ZTA Gateway**, including `CVE-2025-0282` (CVSS 9.0), a stack-based buffer overflow that allows unauthenticated remote code execution, and `CVE-2025-0283` (CVSS 7.0), which enables privilege escalation. Ivanti said `CVE-2025-0282` has been exploited in the wild against Ivanti Connect Secure, prompting urgent guidance for organizations to upgrade to fixed releases and use the **Integrity Checker Tool** to look for signs of compromise. Authorities later warned that `CVE-2025-22457` is also being actively exploited in **Ivanti Connect Secure** and **Pulse Connect Secure**, allowing remote command execution on vulnerable systems. Ivanti Connect Secure addressed that flaw in version **22.7R2.6**, but **Pulse Connect Secure 9.x** has no patch and will not receive one, leaving migration and retirement as the only mitigation for legacy deployments. While Ivanti Policy Secure and ZTA Gateway are also affected by `CVE-2025-22457`, exploitation had not been observed in those products at the time of reporting.
Jun 29, 2026
Mandiant and Google Threat Intelligence Group reported **active zero-day exploitation** of a maximum-severity Dell RecoverPoint for Virtual Machines vulnerability, **CVE-2026-22769** (CVSS 10.0), attributed to **UNC6201**, a suspected PRC-nexus threat cluster. The flaw is described as a **hardcoded-credential issue** affecting versions prior to `6.0.3.1 HF1`, enabling unauthenticated attackers with knowledge of the credential to gain unauthorized access to the underlying OS and establish **root-level persistence**; exploitation has been observed since at least mid-2024. Dell has released remediations and urged customers to upgrade/apply fixes per its security advisory. Post-compromise activity observed in incident response engagements included lateral movement, persistence, and malware deployment, including **SLAYSTYLE**, **BRICKSTORM**, and a newly identified backdoor, **GRIMBOLT**. GRIMBOLT (C# with native ahead-of-time compilation) was observed replacing older BRICKSTORM binaries around September 2025 and is intended to complicate static analysis and improve performance on constrained appliances. The actor also demonstrated techniques to pivot into VMware environments, including creating **“Ghost NICs”** on VMware ESXi for stealthy network movement and using `iptables` for **Single Packet Authorization (SPA)**; initial access was not definitively confirmed, though the actor is known to target edge appliances (e.g., VPN concentrators) for entry.
Jun 29, 2026