Ivanti’s Zero-Day Drama: China-Linked Hackers Exploit Vulnerability, Patch Now!
Ivanti has patched a critical flaw in Connect Secure, exploited by the China-linked group UNC5221 since mid-March 2025. This bug allowed remote code execution, and it’s suggested admins update to version 22.7R2.6 immediately. Meanwhile, UNC5221 was busy dropping malware like it’s hot, proving once again that even hackers appreciate a good exploit.
Hot Take:
In a twist that could make even the most seasoned cyber-sleuth raise an eyebrow, a China-linked group decided to celebrate spring 2025 by planting a virtual garden of malware in the Ivanti Connect Secure landscape. The plot? A zero-day flaw that’s as sneaky as a ninja in the night. Good luck to all the IT admins trying to pull out these weeds!
Key Points:
- Ivanti patched a critical remote code execution vulnerability in Connect Secure, exploited since March 2025.
- The flaw is a stack-based buffer overflow, affecting several Ivanti software versions.
- China-linked group UNC5221 is behind the exploitation, deploying TRAILBLAZE and BRUSHFIRE malware.
- Ivanti has released a fix and plans further security patches soon.
- Admins are advised to monitor logs and reset compromised devices promptly.
Already a member? Log in here