Nation-State Actors Weaponize Ivanti VPN Zero-Days, Deploying 5 Malware Families

Mandiant and Volexity report that suspected nation-state actors (tracked as UNC5221 / UTA0178) exploited two Ivanti Connect Secure zero-days (CVE-2023-46805 and CVE-2024-21887) starting in December 2023 to bypass authentication, inject code, and deploy multiple custom malware families and web shells (including LIGHTWIRE, WIREFIRE/GIFTEDVISITOR, WARPWIRE, ZIPLINE), enabling persistent remote access, credential theft, and tunneling; exploitation scaled in January 2024 with Volexity reporting over 1,700 devices compromised across government, telecom, defense, financial, and other sectors.