Warning: New Malware Emerges in Attacks Exploiting Ivanti VPN Vulnerabilities

Mandiant observed China-nexus actor UNC5221 and other groups exploiting Ivanti Connect Secure and Policy Secure zero-day vulnerabilities (including CVE-2023-46805 and CVE-2024-21887) to deploy multiple web shells and backdoors (CHAINLINE, BUSHWALK, FRAMESTING, LIGHTWIRE variant, WARPWIRE, ZIPLINE) for arbitrary command execution, credential theft, and data exfiltration; vendors and national agencies (Ivanti, BSI, CISA) have issued advisories and mitigations, with CISA ordering urgent disconnects and remediation.