Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation

On Jan 8, 2025 Mandiant and Ivanti disclosed active exploitation of Ivanti Connect Secure vulnerabilities—most notably CVE-2025-0282, an unauthenticated stack-based buffer overflow enabling remote code execution that was observed exploited in the wild beginning mid-December 2024. Mandiant attributes the campaign to UNC5221 (a suspected China-nexus espionage actor) which previously leveraged other Ivanti CVEs and a set of custom malware (ZIPLINE, THINSPOOL, LIGHTWIRE, WARPWIRE) and tunneling/post-exploitation tools; Ivanti has released patches and customers are urged to follow the security advisory to remediate affected appliances.