Researchers Identify Multiple China Hacker Groups Exploiting Ivanti Security Flaws

Multiple China-linked espionage and financially motivated clusters have been observed exploiting zero-day vulnerabilities in Ivanti Connect Secure appliances (CVE-2023-46805, CVE-2024-21887, CVE-2024-21893) to gain persistent access; attackers deployed custom backdoors and tooling (PHANTOMNET, TONERJAM, SPAWN suite, BRICKSTORM, TERRIBLETEA), used web shells and WMI/LDAP abuse for lateral movement and persistence, and targeted across academic, energy, defense, and health sectors—demonstrating active, sophisticated exploitation of edge appliances to enable long-term intrusion and evasion.