Ivanti Connect Secure: A VPN Gateway Under Relentless Zero-Day Fire

Ivanti Connect Secure (formerly Pulse Connect Secure) and Policy Secure are SSL-VPN and network-access-control gateways that terminate remote-access sessions at the network edge. They must face the internet, which makes a single appliance compromise a route to credentials, session tokens and a pivot inside the network — and end-of-support Pulse Connect Secure 9.1x appliances remain widely deployed and unpatchable. Across 2024 and 2025, successive critical zero-days drove repeated mass-exploitation waves, with the China-nexus cluster UNC5221 the recurring suspected actor.

Key Exploited CVEs

The January 2024 pair was exploited as a zero-day from around December 2023; CVE-2024-22024 (an XXE auth bypass) followed in the same window. The listed CVEs are CISA KEV-listed; confirm each against the live KEV catalogue and Ivanti’s advisories before operational use. T1190 T1505.003

Actor & Implants

Mandiant/Google and Volexity attribute the recurring activity to the China-nexus espionage cluster UNC5221 (with the related UNC5337 tracked for CVE-2025-0282 at moderate confidence); attribution is a vendor assessment, and Mandiant notes multiple actors likely targeted CVE-2025-0282. Post-exploitation uses the SPAWN implant ecosystem (SPAWNANT installer, SPAWNMOLE tunneler, SPAWNSNAIL backdoor, SPAWNSLOTH log tampering), plus PHASEJAM (a dropper that blocks legitimate upgrades to preserve access), DRYHOOK (credential harvester), and in 2025 TRAILBLAZE and BRUSHFIRE. See our UNC5221 profile for the actor detail.

Detection & Mitigation

• Patch to current fixed releases; treat end-of-support Pulse Connect Secure 9.1x as retire-not-patch.
• Run Ivanti’s Integrity Checker Tool, but do not treat a clean result as proof of safety — implants such as PHASEJAM survive upgrades and can evade the checker.
• Where compromise is suspected, factory reset before patching; if confirmed, isolate the appliance, rotate all credentials, session secrets and certificates that transited it, and report to CISA/Ivanti.
• Hunt behaviourally on connected systems (credential reuse, anomalous admin/API activity) and watch for unexpected upgrade failures — a PHASEJAM tell — rather than trusting the appliance alone.