Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
|
Description: Ivanti has released security updates to patch a critical Connect Secure remote code execution vulnerability exploited by a China-linked espionage actor to deploy malware since at least mid-March 2025. [...]
April 3rd, 2025 (16 days ago)
|
|
🚨 Marked as known exploited on April 10th, 2025 (9 days ago).
Description: Written by: John Wolfram, Michael Edie, Jacob Thompson, Matt Lin, Josh Murchie
On Thursday, April 3, 2025, Ivanti disclosed a critical security vulnerability, CVE-2025-22457, impacting Ivanti Connect Secure (“ICS”) VPN appliances version 22.7R2.5 and earlier. CVE-2025-22457 is a buffer overflow vulnerability, and successful exploitation would result in remote code execution. Mandiant and Ivanti have identified evidence of active exploitation in the wild against ICS 9.X (end of life) and 22.7R2.5 and earlier versions. Ivanti and Mandiant encourage all customers to upgrade as soon as possible.Â
The earliest evidence of observed CVE-2025-22457 exploitation occurred in mid-March 2025. Following successful exploitation, we observed the deployment of two newly identified malware families, the TRAILBLAZE in-memory only dropper and the BRUSHFIRE passive backdoor. Additionally, deployment of the previously reported SPAWN ecosystem of malware attributed to UNC5221 was also observed. UNC5221 is a suspected China-nexus espionage actor that we previously observed conducting zero-day exploitation of edge devices dating back to 2023.
A patch for CVE-2025-22457 was released in ICS 22.7R2.6 on February 11, 2025. The vulnerability is a buffer overflow with a limited character space, and therefore it was initially believed to be a low-risk denial-of-service vulnerability. We assess it is likely the threat actor studied the patch for the vulnerability in ICS 22.7R2.6 and uncovered through a ...
EPSS Score: 9.86%
April 3rd, 2025 (16 days ago)
|
|
Description: A recent alert from CISA builds on previous research about a vulnerability in Ivanti products that China-linked hackers have used to insert malware into networks.
April 2nd, 2025 (17 days ago)
|
|
Description: More than a year away from leading the NSA and Cyber Command, Paul Nakasone told the Click Here podcast that they could ask him anything. So they did. About China, AI, DOGE and more.
April 1st, 2025 (18 days ago)
|
|
Description: Cybersecurity researchers have shed light on a new China-linked threat actor called Earth Alux that has targeted various key sectors such as government, technology, logistics, manufacturing, telecommunications, IT services, and retail in the Asia-Pacific (APAC) and Latin American (LATAM) regions.
"The first sighting of its activity was in the second quarter of 2023; back then, it was
April 1st, 2025 (18 days ago)
|
|
March 31st, 2025 (19 days ago)
|
|
March 27th, 2025 (22 days ago)
|
|
Description: AÂ China-linked cyberespionage group known as 'FamousSparrow'Â was observed using a new modular version of its signature backdoor 'SparrowDoor' against a US-based trade organization. [...]
March 27th, 2025 (23 days ago)
|
|
Description: Cybercriminals in China have figured out how to undermine the strengths of mobile messaging protocols.
March 26th, 2025 (24 days ago)
|
|
|
Description: The persistent threat actor was caught using sophisticated Web shell techniques against an unnamed telecommunications company in Asia.
March 24th, 2025 (26 days ago)
|