CVE AdvisoryCRITICALIntermediate5 min read

Ivanti Connect Secure Zero-Day (CVE-2025-22457) Exploited by China-Nexus UNC5221

A critical stack-based buffer overflow in Ivanti Connect Secure VPN was exploited as a zero-day by UNC5221 (China-nexus) to deploy TRAILBLAZE dropper and BRUSHFIRE passive backdoor on edge devices globally.

April 3, 2025Verified

Ivanti Security Advisory Mandiant Blog CISA Advisory AA25-093A

What Happened

Ivanti disclosed CVE-2025-22457, a critical (CVSS 9.0) stack-based buffer overflow affecting Connect Secure, Policy Secure, and ZTA Gateways. Mandiant confirmed active exploitation by UNC5221, a China-nexus threat actor previously linked to Volt Typhoon operations.

Malware Deployed

TRAILBLAZE: In-memory dropper executing via shell script
BRUSHFIRE: Passive backdoor with encrypted C2 communication injected into running processes
SPAWN: Malware ecosystem (SPAWNANT, SPAWNMOLE, SPAWNSNAIL) for persistence

Exploitation Window

Mandiant observed exploitation beginning in mid-March 2025, approximately three weeks before the April 3rd disclosure. The vulnerability was initially introduced when Ivanti tried to fix an earlier bug (CVE-2025-0282) in Connect Secure 22.7R2.5 — the patch was incomplete.

Recommended Actions

Upgrade to Connect Secure 22.7R2.6 or later immediately.

Run the Ivanti Integrity Checker Tool (ICT) before and after patching
Factory reset compromised appliances — do not trust software-only remediation
Rotate all credentials accessible via the VPN gateway
Review CISA Advisory AA25-093A for detailed IOCs
Enable external authentication logging and audit auth events

Ivanti VPN Remote Code Execution T1190 Exploit Public-Facing App Government Critical Infrastructure

NEWSHIGHCVE-2026-18844

Pulsetto Vagus Nerve Stimulator

Successful exploitation of this vulnerability could allow an attacker to use hidden commands to disable electrical safety mechanisms or modify other stimulation output settings. The following versions of Pulsetto Vagu...

WHY IT MATTERS

Successful exploitation of this vulnerability could allow an attacker to use hidden commands to disable electrical safety mechanisms or modify other stimulation output settings.

FirmwareHealthcareCritical Infrastructure

5h ago· 3 min read

NEWSHIGHCVE-2025-71409

CPDLC over ATN-B1 Vulnerabilities

ATN-B1 CPDLC relies on legacy clear text unauthenticated radio frequency links. Research demonstrates that these characteristics allow unauthorized message injection, denial-of-service conditions, and forced session r...

WHY IT MATTERS

Official CISA advisory — read the full bulletin for impact and mitigation guidance before acting.

Denial of ServiceCritical Infrastructure

4d ago· 6 min read

NEWSMEDIUMCVE-2026-17264

Medixant RadiAnt DICOM

Successful exploitation of this vulnerability could allow an attacker to cause the application to crash if a maliciously crafted DICOM file is opened. The following versions of Medixant RadiAnt DICOM are affected: Rad...

WHY IT MATTERS

Successful exploitation of this vulnerability could allow an attacker to cause the application to crash if a maliciously crafted DICOM file is opened.

HealthcareCritical Infrastructure

5d ago· 3 min read

What Happened

Malware Deployed

Exploitation Window

Recommended Actions

Related

Pulsetto Vagus Nerve Stimulator

CPDLC over ATN-B1 Vulnerabilities

Medixant RadiAnt DICOM