#unc5325 — Public Fediverse posts

"⚔️ Cutting Edge Cyber Espionage: Ivanti Zero-Days Under Siege by UNC5325 ⚔️"

#Mandiant & #Ivanti's latest investigation unveils a sophisticated cyber-espionage campaign targeting Ivanti Connect Secure VPN appliances. #UNC5325, a China-nexus group, exploited a series of zero-day vulnerabilities, including CVE-2024-21893, to deploy novel malware and evade detection. Despite efforts, their persistence mechanisms faltered due to encryption key mismatches. 🛡️🔐

A new Integrity Checking Tool (ICT) is available for Ivanti customers, emphasizing the urgency of updating and patching network appliances. The exploitation showcases advanced techniques, including LotL and custom malware like LITTLELAMB.WOOLTEA, highlighting the importance of robust cyber defenses.

Ivanti disclosed five critical vulnerabilities, with #CVE-2024-21893 and #CVE-2024-22024 posing significant risks. The SSRF and XXE vulnerabilities enable attackers to bypass security measures and access restricted resources, underscoring the need for immediate remediation.

Attribution to #UNC5325 ties this campaign to China, with tactics, techniques, and malware indicating a high level of sophistication. This operation's breadth and depth signal a continued threat from state-sponsored actors against critical network infrastructure.

Let's ensure our defenses are updated and vigilant against these evolving threats. #CyberSecurity #Ivanti #ZeroDay #APT #UNC5325 #CVE2024 Mitre - UNC5325 #UNC3886

Source: Mandiant Team - Investigating Ivanti Exploitation & Persistence