More Ivanti VPN Zero-Days Fuel Attack Frenzy as Patches Finally Roll

Ivanti has released staggered patches and mitigations for multiple zero-day vulnerabilities in Connect Secure and Policy Secure appliances after active exploitation was observed; Mandiant attributes many attacks to China-backed APT UNC5221 while noting other actors have adopted the tools. The report details deployed implants — including multiple web shells (LightWire variant, ChainLine, FrameSting, Bushwalk), the ZipLine passive backdoor, WarpWire credential-stealers, and various post-exploitation tools — and warns of targeted and mass exploitation, supply-chain risks, and recommends immediate application of mitigations and patches.