Nominet probes network intrusion linked to Ivanti zero-day exploit

Nominet, the UK domain registry for millions of .uk domains, reported a network intrusion traced to exploitation of an Ivanti zero-day (CVE-2025-0282) used to access systems via Ivanti VPN products; the activity is linked to threat clusters UNC5337 (and ties to UNC5221) and has resulted in deployment of known and novel malware families (Spawn, Dryhook, Phasejam). Ivanti and Mandiant disclosed the vulnerability and released patches for affected products, while mitigations and investigations are ongoing and customers have been notified.