China-Linked Threat Group Exploits Ivanti Bug

A China-nexus cyber-espionage actor identified as UNC5221 is actively exploiting a critical buffer overflow (CVE-2025-22457) in Ivanti Connect Secure, Pulse Connect Secure and related gateways to achieve remote code execution; the group drops two new malware families (Trailblaze — an in-memory dropper — and Brushfire — a passive backdoor) along with additional toolset components. Ivanti and Mandiant confirmed exploitation in the wild, Ivanti raised the vulnerability to CVSS 9.0, and organizations are urged to upgrade, patch, or factory-reset compromised appliances.