NSA says it’s tracking Ivanti cyberattacks as hackers hit US defense sector

The report details mass exploitation of Ivanti Connect Secure VPN vulnerabilities by a suspected China-backed APT (UNC5325) targeting the U.S. defense sector and other industries; NSA and CISA confirm tracking and warn of root-level persistence techniques that may survive factory resets, while Mandiant and Akamai report widespread active exploitation and high volumes of attack attempts.