Security researchers have identified a critical vulnerability in Ivanti Connect Secure (ICS) VPN appliances that is being actively exploited by suspected Chinese threat actors. Google Threat Intelligence analysts identified that following successful exploitation, the threat actors deploy multiple malware families, including two newly discovered tools – TRAILBLAZE and BRUSHFIRE – alongside their previously documented SPAWN ecosystem of malware. Evidence suggests exploitation began in mid-March 2025, with attackers leveraging the vulnerability to deploy sophisticated malware strains designed for espionage operations. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Security experts recommend organizations immediately upgrade affected Ivanti Connect Secure appliances to version 22.7R2.6 or later and utilize the Integrity Checker Tool to identify any suspicious activity. Frida 16.7.0, the latest version of the popular dynamic instrumentation toolkit, has powerful new APIs specifically designed for advanced threat monitoring and security analysis. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. This group has demonstrated sophisticated capabilities, including the ability to reverse-engineer security patches to develop working exploits. According to security researchers, the group targets a wide range of countries and vertical sectors, demonstrating an aggressive operational tempo and extensive toolset. After successfully exploiting the vulnerability, attackers deploy a sophisticated attack chain starting with a shell script dropper. This sophisticated technique enables attackers to maintain a persistent presence while minimizing detection risk, as they operate entirely in memory without writing malicious files to disk. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. This initial script executes TRAILBLAZE, an in-memory dropper written in bare C using raw syscalls, designed to be minimal and stealthy. The vulnerability’s exploitation represents a concerning evolution in UNC5221’s tactics, as they transition from exclusively using zero-day vulnerabilities to also leveraging n-day flaws in their arsenal.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 04 Apr 2025 08:05:38 +0000