Chinese Hackers Exploiting VPN Flaws to Deploy KrustyLoader Malware

A pair of zero-day vulnerabilities in Ivanti Connect Secure VPN appliances (CVE-2023-46805 and CVE-2024-21887) are being actively exploited to achieve unauthenticated remote code execution. Threat actors — including a Chinese nation-state group tracked as UTA0178/UNC5221 — have used the flaws to deploy a Rust loader called KrustyLoader that fetches the Sliver post-exploitation framework; other adversaries have dropped cryptomining and Rust-based malware. Patches were delayed and only temporary mitigations were offered at the time of reporting.