Chinese Threat Actor Targets Ivanti Remote Access Devices: A Year of Vulnerabilities and Exploits

Ivanti Under Siege: Chinese Threat Actor Exploits Vulnerabilities Once Again

In a troubling resurgence, a Chinese threat actor, identified as UNC5337, is once again targeting Ivanti remote access devices, exploiting newly discovered critical vulnerabilities. This follows a year marked by a barrage of significant security issues affecting Ivanti’s products, including authentication bypasses and SQL injection flaws.

This latest series of breaches hinges on vulnerabilities in Ivanti’s Connect Secure (ICS) and Policy Secure gateways, with the most severe, rated critical on the Common Vulnerability Scoring System (CVSS), allowing unauthorized code execution. Although Ivanti had pledged to prioritize secure engineering following last year’s issues, the group has already begun exploiting these new flaws, raising alarms in cybersecurity circles.

“UNC5337’s techniques highlight how sophisticated these attacks are,” notes Arctic Wolf CISO Adam Marrè. The group’s notable use of the "Spawn" malware family, which has been observed in previous exploits, underscores their expertise in infiltrating Ivanti’s systems. Tools like SpawnAnt and SpawnSnail enable extensive control and surveillance once a system is compromised.

Researchers at Mandiant warn that over 2,000 instances of ICS devices could be vulnerable globally, particularly in the US, France, and Spain. Ivanti, responding to this maturity of threat, is urging clients to implement immediate patches and utilize their built-in Integrity Checker Tool to scan for infections.

While cybersecurity leaders emphasize the need for timely updates to mitigate such risks, the task is not without its challenges. Administrators face tough decisions regarding potential downtime versus the urgency of patching systems—a dilemma that could further strain an already beleaguered IT environment.

As the threat escalates, vigilance and prompt action become paramount for organizations reliant on Ivanti solutions.