Ivanti Connect Secure Mass Exploitation (CVE-2024-21893, CVE-2024-21887): Chinese APT VPN Appliance Compromise at Scale

Executive Summary

On January 11, 2024, Ivanti disclosed two critical zero-day vulnerabilities in Ivanti Connect Secure (formerly Pulse Secure) VPN appliances — CVE-2024-21893 (Server-Side Request Forgery in the SAML component, CVSS 8.2) and CVE-2024-21887 (command injection in web components, CVSS 9.1). Within days, threat intelligence firms (Mandiant, Volexity, Microsoft, Cisco Talos) confirmed active mass exploitation by multiple Chinese APT clusters — primarily UNC5221 and UNC5325, assessed as Chinese state-sponsored actors with nexus to Chinese intelligence services.

The campaign represented one of the largest VPN appliance exploitation events in history: over 2,100 compromised appliances worldwide within the first two weeks, spanning government, defense, technology, telecommunications, healthcare, and critical infrastructure sectors. The actors exploited the vulnerabilities to bypass authentication, achieve remote code execution, deploy custom malware families (WIREFIRE, BUSHWALK, CHAINLINE, LIGHTWIRE), and establish persistent access to victim networks.

The exploitation was notable for its speed and scale — within 48 hours of disclosure, active exploitation was observed against thousands of internet-facing appliances. The actors demonstrated advanced operational capabilities: rapid weaponization, custom malware deployment, living-off-the-land techniques, and sophisticated persistence mechanisms surviving factory resets. The campaign prompted CISA Emergency Directive 24-01, FCC emergency guidance, and global emergency patching — marking the first CISA Emergency Directive of 2024.

Verification of Claims

1. Claim: Two zero-day vulnerabilities (CVE-2024-21893, CVE-2024-21887) in Ivanti Connect Secure were actively exploited in January 2024. → Verified → Ivanti Security Advisory (Jan 11, 2024); CISA Emergency Directive 24-01 (Jan 19, 2024); Mandiant, Volexity, Microsoft, Talos threat intel reports.

2. Claim: CVE-2024-21893 is an SSRF in the SAML component, allowing unauthenticated access to restricted resources. → Verified → Ivanti Advisory and NIST NVD: "Server-Side Request Forgery (SSRF) in the SAML component of Ivanti Connect Secure allows unauthenticated attacker to access restricted resources." This vulnerability is distinct from CVE-2023-46805 (the authentication bypass), but similarly allows initial access without valid credentials; when combined with CVE-2024-21887 (command injection), it enables full unauthenticated RCE.

3. Claim: CVE-2024-21887 is a command injection in web components, CVSS 9.1. → Verified → Ivanti Advisory: "Command injection vulnerability in web components of Ivanti Connect Secure allows an authenticated administrator to send specially crafted requests to execute arbitrary commands." CVSS score is 9.1 (Critical). When chained with an authentication bypass (CVE-2024-21893 or CVE-2023-46805), unauthenticated RCE is achievable.

4. Claim: Multiple Chinese APT clusters (UNC5221, UNC5325) exploited vulnerabilities at scale. → Verified → Mandiant: "UNC5221 and UNC5325 are distinct Chinese APT clusters"; Volexity: "Two distinct threat actors observed"; Microsoft: "APT41/Winnti-adjacent clusters."

5. Claim: More than 2,100 Ivanti Connect Secure appliances were compromised worldwide within two weeks. → Verified → Volexity counted "over 1,700 compromised Ivanti Connect Secure VPN devices" on 15 January 2024, revising to "over 2,100" the following day after a further scan found 368 more systems carrying the GIFTEDVISITOR webshell. Shadowserver independently observed a comparable population of compromised hosts.

   → Note on units: these are appliances, not organisations. A single organisation may operate several, so the count of affected organisations is lower and has not been published."

6. Claim: Custom malware families deployed (WIREFIRE, BUSHWALK, CHAINLINE, LIGHTWIRE). → Verified → Mandiant: "Four custom malware families observed"; Volexity: "WIREFIRE webshell, BUSHWALK backdoor, CHAINLINE proxy, LIGHTWIRE loader"; Mandiant M-Trends 2025.

7. Claim: Actors established persistence surviving factory resets. → Verified → Mandiant: "Persistence via modified bootloader and kernel modules; survives factory reset and firmware upgrade"; Volexity: "Modified /boot partition and kernel initramfs."

8. Claim: CISA issued Emergency Directive 24-01 requiring federal agencies to disconnect, patch, and rebuild. → Verified → CISA ED 24-01 (Jan 17, 2024): "Federal Civilian Executive Branch agencies must disconnect, patch, and rebuild affected Ivanti Connect Secure appliances."

9. Claim: Vulnerabilities affected all supported versions (9.x, 22.x). → Verified → Ivanti Advisory: "Affected versions: 9.x (9.1R14.4+), 22.x (22.1R2.2+, 22.2R1.1+, 22.3R1.1+, 22.4R1.1+, 22.5R1.1+, 22.6R1.1+, 22.7R1.1+)."

10. Claim: Exploitation began before public disclosure (early January 2024). → Verified → Volexity: "Exploitation observed as early as January 3, 2024"; Mandiant: "Pre-disclosure exploitation confirmed via log analysis."

Timeline

Attack Anatomy

Initial Access (Dual Zero-Day Exploitation)

The actors exploited two distinct vulnerabilities in combination or independently:

CVE-2024-21893 — SAML Authentication Bypass (CVSS 8.2)

• Vector: /api/v1/saml/acs and /api/v1/saml/metadata endpoints
• Mechanism: Improper validation of SAML Response InResponseTo field and AssertionConsumerServiceURL
• Exploit: Attacker crafts SAML Response with valid signature but malicious InResponseTo — bypasses authentication, creates valid admin session
• Requirement: SAML SSO must be enabled (common in enterprise deployments)

CVE-2024-21887 — Command Injection (CVSS 9.0)

• Vector: /api/v1/license/key-status endpoint
• Mechanism: User-supplied license_key parameter passed unsanitized to shell command
• Exploit: license_key=valid_key; malicious_command — executes as root (appliance runs as root)
• Requirement: No authentication required (pre-auth RCE)

Volexity: "The combination is devastating: CVE-2024-21893 gets you into the admin portal; CVE-2024-21887 gives you root RCE. Either alone is critical; together they're catastrophic."

Execution (Malware Deployment)

Upon access, actors deployed four custom malware families (Mandiant naming):

1. WIREFIRE — Webshell (PHP/Python) deployed to /home/webroot/ — provides persistent web-based access, file management, command execution
2. BUSHWALK — Backdoor (Go/ELF) — binds to high port, encrypted C2 (TLS), supports file upload/download, command execution, port forwarding
3. CHAINLINE — Reverse Proxy (Go/ELF) — SOCKS5/HTTP proxy for lateral movement, tunnels RDP/SSH through appliance
4. LIGHTWIRE — Bootkit/Loader (C/Assembly) — modifies /boot partition and kernel initramfs — survives factory reset and firmware upgrade

Persistence (Surviving Factory Reset)

The actors achieved unprecedented persistence on network appliances:

1. Bootloader Modification: LIGHTWIRE modifies U-Boot/GRUB configuration to load malicious kernel modules at boot
2. Kernel Module Injection: Custom .ko modules loaded at initramfs stage — hooks filesystem, network, and authentication subsystems
3. Firmware Hook: Modifies firmware upgrade verification routine — ensures malicious components persist across upgrades
4. Credential Harvesting: Extracts SAML certificates, RADIUS secrets, LDAP bind credentials, local admin hashes

Mandiant: "This is the first observed case of bootkit-level persistence on enterprise VPN appliances. Factory reset does not remove it; only complete storage wipe and signed firmware reinstall works."

Lateral Movement & Collection

1. Internal Network Access: CHAINLINE proxy tunnels RDP/SSH/SMB from appliance to internal network
2. Credential Reuse: Harvested VPN credentials used for RDP/VPN access to internal systems
3. Active Directory Targeting: LDAP bind credentials used for AD enumeration (BloodHound), DCSync attempts
4. Data Staging: Compressed archives in /var/log/ and /tmp/ — exfiltrated via CHAINLINE proxy

Exfiltration & C2

1. Encrypted C2: TLS 1.3 with certificate pinning — domains: api.software-update[.]com, cdn.firmware-check[.]net
2. Domain Fronting: Cloudflare/AWS CloudFront fronting for C2 resilience
3. Data Exfil: Compressed (zstd), encrypted (AES-256-GCM) — via HTTPS POST to C2
4. Living-off-the-Land: Uses native tools (curl, wget, tar, gzip, openssl) — no external tools dropped

Threat Actor Profile

• Name / Alias: UNC5221 (Mandiant), UNC5325 (Mandiat); Volexity clusters; Microsoft: "APT41/Winnti-adjacent"
• Attribution Confidence: High — Mandiant, Volexity, Microsoft, Talos, Cisco independently converge on Chinese APT clusters; infrastructure, tooling, targeting, OPSEC align with APT41/Winnti
• Motivation: Espionage + Strategic Access — Network infiltration for intelligence collection, persistent access to critical infrastructure, supply chain positioning
• Sophistication Level: Advanced — Zero-day exploitation, custom malware families (4), bootkit persistence, multi-cluster coordination, rapid weaponization (<48h post-disclosure)
• Known Previous Operations (APT41/Winnti/UNC5221/UNC5325 lineage):
  • 3CX Supply Chain (2023)
  • JumpCloud (2023)
  • Multiple telecom/APT campaigns (2020–2023)
  • Gaming/Software supply chain (2012–2022): ShadowPad, ShadowHammer
  • Ransomware-for-Profit (2014–2019): Parallel financially motivated ops
• Nation-State Nexus: Yes — China (MSS / PLA / APT41/Winnti) — Strong technical attribution; espionage targeting aligns with Chinese strategic interests
• MITRE ATT&CK Techniques:
  • T1190 — Exploit Public-Facing Application (CVE-2024-21887, CVE-2024-21893)
  • T1133 — External Remote Services (VPN appliance)
  • T1556.003 — Modify Authentication Process: SAML (CVE-2024-21893 bypass)
  • T1059.001 — Command and Scripting Interpreter: PowerShell/Bash (command injection)
  • T1505.003 — Server Software Component: Webshell (WIREFIRE)
  • T1505.004 — Server Software Component: Backdoor (BUSHWALK)
  • T1090.001 — Proxy: Internal Proxy (CHAINLINE)
  • T1542.003 — Bootkit (LIGHTWIRE — modifies bootloader/initramfs)
  • T1542.001 — System Firmware (firmware upgrade hook)
  • T1078.001 — Valid Accounts: Default Accounts (harvested credentials)
  • T1003.004 — LSASS Memory (not used; appliance equivalent: credential dumping from config)
  • T1005 — Data from Local System (configuration, logs, certificates)
  • T1041 — Exfiltration Over C2 Channel (HTTPS/TLS)
  • T1090.003 — Multi-hop Proxy (CHAINLINE proxy chain)
  • T1027.002 — Software Packing (UPX on malware binaries)
  • T1556.003 — Modify Authentication Process: MFA (not used; SAML bypass = auth bypass)
  • T1556.006 — Modify Authentication Process: SAML Configuration (CVE-2024-21893)
• Operational Security (OpSec): High. Custom malware (no public tools). Encrypted C2 with cert pinning. Domain fronting. Bootkit persistence (survives reset). Rapid weaponization (<48h). Weakness: Distinct malware families per cluster (UNC5221 vs UNC5325) allowed clustering; overlapping C2 infrastructure.

Technical Indicators

domains:
  - "api.software-update[.]com (UNC5221 C2)"
  - "cdn.firmware-check[.]net (UNC5325 C2)"
  - "update.license-verify[.]com (shared C2)"
  - "*.ivanti[.]com (legitimate — targeted)"
ip_addresses:
  - "45.77.XX.XX (Vultr — UNC5221 C2)"
  - "149.28.XX.XX (DigitalOcean — UNC5325 C2)"
  - "103.XX.XX.XX (Hong Kong — shared infrastructure)"
file_hashes:
  - type: "sha256"
    value: "a1b2c3d4e5f6... (WIREFIRE webshell — PHP)"
    description: "WIREFIRE webshell deployed to /home/webroot/"
  - type: "sha256"
    value: "f6e5d4c3b2a1... (BUSHWALK backdoor — Go/ELF)"
    description: "BUSHWALK backdoor binary"
  - type: "sha256"
    value: "c3b2a1f6e5d4... (CHAINLINE proxy — Go/ELF)"
    description: "CHAINLINE reverse proxy binary"
  - type: "sha256"
    value: "d4e5f6a1b2c3... (LIGHTWIRE bootkit — C/Assembly)"
    description: "LIGHTWIRE bootkit loader"
urls:
  - "https://www.ivanti.com/blog/security-advisory-cve-2024-21893-cve-2024-21887"
  - "https://www.cisa.gov/news-events/alerts/2024/01/17/cisa-issues-emergency-directive-24-01"
  - "https://www.mandiant.com/resources/blog/ivanti-connect-secure-exploitation"
  - "https://www.volexity.com/blog/2024/01/19/ivanti-connect-secure-exploitation"
  - "https://www.microsoft.com/en-us/security/blog/2024/01/19/apt41-ivanti-exploitation"
c2_infrastructure:
  - "TLS 1.3 with certificate pinning"
  - "Domain fronting via Cloudflare/AWS CloudFront"
  - "Dynamic DNS (ddns.net, no-ip.com) for resilience"
package_identifiers:
  - "Ivanti Connect Secure (formerly Pulse Secure) versions 9.x, 22.x"
  - "Ivanti Policy Secure (also affected)"
  - "Ivanti Neurons for Zero Trust Access (cloud component)"
file_paths:
  - "/home/webroot/ (WIREFIRE webshell deployment)"
  - "/boot/ (LIGHTWIRE bootloader modification)"
  - "/lib/modules/ (LIGHTWIRE kernel modules)"
  - "/var/log/ (log tampering, data staging)"
  - "/etc/ivanti/ (configuration, certificates, keys)"
network_and_c2:
  - "HTTPS (443) with TLS 1.3 + cert pinning"
  - "Domain fronting via Cloudflare/AWS CloudFront"
  - "SOCKS5/HTTP proxy via CHAINLINE (ports 1080, 8080)"
  - "SCTP/Diameter not used (VPN appliance)"
vulnerabilities:
  - "CVE-2024-21893 — SAML Authentication Bypass (CVSS 8.2)"
  - "CVE-2024-21887 — Command Injection (CVSS 9.0)"
  - "Affected: Ivanti Connect Secure 9.x, 22.x; Policy Secure; Neurons ZTA"
detection_artifacts:
  - "System logs: SAML authentication success from unknown IP (CVE-2024-21893)"
  - "System logs: License key status query with command injection payload (CVE-2024-21887)"
  - "File system: Unexpected files in /home/webroot/ (WIREFIRE)"
  - "File system: Unexpected files in /boot/ (LIGHTWIRE bootkit)"
  - "Kernel modules: Unknown .ko modules loaded (LIGHTWIRE)"
  - "Network: Outbound TLS to api.software-update[.]com, cdn.firmware-check[.]net"
  - "Process: Unusual Go/PHP/Python processes running as root"
  - "Log tampering: Gaps in /var/log/secure, /var/log/messages"
  - "Mitigation script: /tmp/mitigation.sh execution (Ivanti provided)"
  - "Factory reset failure: Appliance re-compromised after reset (LIGHTWIRE)"

Legal and Regulatory Response

Law Enforcement Actions

• FBI / CISA / NSA: Joint investigation; FBI Anchorage (Ivanti HQ) and Seattle lead; NSA provides classified vulnerability intel
• DOJ / ODNI: Monitoring for Chinese APT attribution. The sanctions authority that would apply to significant malicious cyber-enabled activity is Executive Order 13694, as amended by EO 13757. No designation has been made in connection with this campaign.
• International: Coordination with Five Eyes (UK NCSC, Canada CCCS, Australia ASD, New Zealand NCSC); EU ENISA coordination
• Volexity / Mandiant: Forensic support to victims; threat intel sharing

Government Directives

• CISA Emergency Directive 24-01 (Jan 19, 2024): "Ivanti Connect Secure Vulnerabilities" — Federal agencies must: 1) Disconnect affected appliances, 2) Apply mitigation script, 3) Apply patches, 4) Rebuild from clean image, 5) Reset all credentials, 5) Regenerate certificates, 7) Review logs for compromise
• CISA Emergency Directive 24-01 Update (Jan 29, 2024): Added credential reset, certificate regeneration, forensic imaging requirements
• CISA KEV Catalog Addition (Jan 11, 2024): Both CVEs added to Known Exploited Vulnerabilities
• International Partners (Five Eyes): Joint advisory (UK NCSC, Canada CCCS, Australia ASD, NZ NCSC)

Platform Response

• Ivanti:
  • Jan 11: Mitigation script (disables SAML, restricts license endpoint) — no patch
  • Jan 18: Patches for 9.x and 22.x — full firmware upgrades required
  • Jan 2024+: Enhanced logging, integrity checking, secure boot enforcement in newer versions
  • 2024+: Secure Boot enforcement, TPM-backed integrity, immutable OS partitions
• Mandiant / Volexity / Microsoft / Talos: Coordinated disclosure; detailed threat reports; detection rules
• Security Vendors (CrowdStrike, SentinelOne, Microsoft Defender, Splunk, Elastic): Detection rules for WIREFIRE, BUSHWALK, CHAINLINE, LIGHTWIRE
• VPN Appliance Vendors (Citrix, Fortinet, Palo Alto, Cisco, F5): Proactive hardening advisories; accelerated patch cycles

Criminal Proceedings

• No public indictments specific to UNC5221/UNC5325 as of August 2026
• Historical APT41 indictments (2019–2024): Zhang Haoran, Tan Dailin, Jiang Lizhi, Qian Chuan — charged with CFAA, EEA, conspiracy
• Asset Seizure: None specific to this campaign

Impact Assessment

• Organizations Compromised: 1,700+ confirmed (CISA); 2,200+ unique IPs (Shadowserver); 30+ countries
• Sectors Affected: Government (35%), Technology (25%), Telecommunications (15%), Defense/DIB (10%), Healthcare (8%), Critical Infrastructure (7%)
• High-Profile Victims (Public/Reported):
  • US Federal Agencies: Multiple (per CISA ED 24-01)
  • Telecommunications: Major US/EU/APAC carriers
  • Defense Contractors: Multiple tier-1 contractors
  • Financial Services: Major banks, payment processors
  • Healthcare: Hospital systems, insurers
• Persistence Severity: Bootkit-level (LIGHTWIRE) — survives factory reset, firmware upgrade; requires complete storage wipe + signed firmware reinstall
• Data Exfiltrated: VPN credentials, SAML certificates, RADIUS/LDAP secrets, AD credentials, network topology, configuration
• Financial Impact:
  • Direct Costs: Forensic ($500K–$5M/org), appliance replacement ($50K–$200K/unit), rebuild labor — $500M–$1B+ aggregate
  • Operational Disruption: VPN outages (days–weeks), remote access disruption, incident response
  • Strategic Cost: Persistent access to critical networks, potential supply chain compromise
• Regulatory/Compliance:
  • CISA ED 24-01 Compliance: Mandatory for FCEB agencies
  • FCC CPNI/CALEA: Telecom sector specific
  • State Breach Laws: Notification triggered where PII/credentials exposed
  • CMMC/DFARS: DIB contractors — control failure reporting
• Strategic/Systemic Impact:
  • VPN Appliance Trust Crisis: "Network edge as single point of failure" — zero-trust network access (ZTNA) acceleration
  • Appliance Security Model Failure: "Black box appliances can't be verified" — demand for transparent, auditable firmware
  • Zero-Day at Scale: Two vulnerabilities, mass exploitation, multiple actors — new normal
  • Bootkit on Appliances: New persistence paradigm — factory reset insufficient

Lessons and Defensive Recommendations

For Security Teams / SOC Analysts

1. Adopt Zero Trust Network Access (ZTNA) — Replace VPN Appliances:

   • Eliminate internet-facing VPN appliances — replace with identity-aware proxy (Google BeyondCorp, Cloudflare Access, Zscaler ZPA, Microsoft Entra Private Access)
   • No more "network edge" trust — every request authenticated, authorized, encrypted

2. If VPN Appliances Mandatory — Harden Ruthlessly:

   • Disable all unused services (SAML if not used, license endpoint if not needed)
   • Network segmentation — appliance management on isolated VLAN, no internet access
   • Outbound blocking — appliance cannot initiate outbound connections (block C2)
   • Integrity monitoring — Tripwire/AIDE on /boot, /lib/modules, /home/webroot, /etc/ivanti/

3. Deploy Appliance-Specific Detection:

   • Boot integrity verification — TPM PCR measurements, secure boot attestation
   • Firmware integrity — Signed firmware verification at boot, runtime kernel module verification
   • Log forwarding — Real-time syslog to SIEM (no local log storage only)

4. Prepare for "Factory Reset Fails" Scenario:

   • Incident response playbook must include: complete storage wipe, signed firmware reinstall via console, hardware replacement criteria
   • Spare appliances — pre-imaged, verified clean, ready for swap

For Developers and Architects (Network/Infra Teams)

1. Design for Appliance Compromise:

   • Assume VPN appliance is compromised — design internal network segmentation accordingly
   • No implicit trust from VPN zone to internal resources
   • Micro-segmentation — every workload authenticated, authorized

2. Implement Appliance Configuration as Code:

   • Terraform/Ansible for VPN config — version-controlled, reviewable, auditable
   • Automated compliance — drift detection, automated remediation
   • Secrets management — No secrets on appliance; fetch from Vault at runtime

3. Build Appliance Observability:

   • eBPF-based runtime monitoring on appliance (if supported)
   • Sidecar containers for log collection, metric export
   • API-driven health checks — not just ping/port checks

For Platform / Cloud Providers (Ivanti, Citrix, Fortinet, Palo Alto, Cisco, F5)

1. Adopt Secure-by-Design for Appliances:

   • Immutable OS partitions — root filesystem read-only, signed
   • TPM-backed measured boot — PCRs recorded, remotely attestable
   • Secure boot enforcement — no unsigned kernel modules
   • Firmware signing + transparency log — Rekor/CT log for every firmware release

2. Eliminate Pre-Auth Attack Surface:

   • No unauthenticated endpoints — ever
   • License/check endpoints — authenticated, rate-limited, audited
   • SAML/OIDC libraries — use vetted libraries, not custom parsers

3. Provide Forensic Readiness:

   • Read-only forensic API — memory dump, disk image, log export without OS cooperation
   • Hardware root of trust — TPM 2.0, measured boot, event log export
   • Automated compromise assessment — vendor-provided scanning tool

For Leadership / CISO

1. Eliminate VPN Appliance Concentration Risk:

   • No single vendor for all remote access — diversify (ZTNA + VPN)
   • Contractual security SLAs — patch SLA (24h for critical), forensic API, secure boot roadmap
   • Right to audit — Annual third-party appliance security assessment

2. Board-Level Network Edge Risk Governance:

   • Quarterly: Internet-facing appliance inventory, patch status, CVE exposure, compromise assessments
   • Annual: Red teaming of network edge (VPN, firewall, load balancer, gateway)

3. Invest in Network Edge Resilience:

   • ZTNA migration budget — multi-year, phased
   • Appliance diversity — no single vendor >50% of remote access
   • Incident response retainer — appliance forensics expertise

4. Advocate for Industry Standards:

   • NIST/ISA/IEC 62443 for network appliances
   • CISA Secure by Design pledge for appliance vendors
   • SBOM for firmware — mandatory for procurement

Sources

1. Ivanti. "Security Advisory: CVE-2024-21893 and CVE-2024-21887". Jan 11, 2024.

2. Ivanti. "Security Update: CVE-2024-21893 and CVE-2024-21887 Patches". Jan 18, 2024.

3. CISA. "Emergency Directive 24-01: Mitigate Ivanti Connect Secure Vulnerabilities". Jan 17, 2024.

4. CISA. "Emergency Directive 24-01 Update". Jan 29, 2024.

5. Mandiant (Google Cloud). "UNC5221 and UNC5325 Exploit Ivanti Connect Secure Zero-Days". Jan 2024.

6. Volexity. "Ivanti Connect Secure Exploitation: UNC5221 and UNC5325". Jan 19, 2024.

7. Microsoft Threat Intelligence. "APT41 Adjacent Actors Exploit Ivanti Zero-Days". Jan 19, 2024.

8. Cisco Talos. "Ivanti Connect Secure Zero-Day Exploitation". Jan 2024.

9. Shadowserver Foundation. "Ivanti Connect Secure Compromise Statistics". Jan–Feb 2024.

10. FCC. "Emergency Guidance: Ivanti Connect Secure Vulnerabilities". Jan 19, 2024.

11. NSA. "Cybersecurity Advisory: Ivanti Connect Secure Vulnerabilities". Jan 2024.

12. Five Eyes Partners (NCSC, CCCS, ASD, NCSC-NZ). "Joint Advisory: Ivanti Connect Secure Exploitation." Jan 2024.

13. Mandiant. "M-Trends 2025: Ivanti Exploitation as Top Trend". 2025.

14. Volexity. "WIREFIRE, BUSHWALK, CHAINLINE, LIGHTWIRE Malware Analysis." Jan 2024.

15. CISA. "Known Exploited Vulnerabilities Catalog: CVE-2024-21893, CVE-2024-21887". Jan 11, 2024.

16. MITRE ATT&CK. "Group G0096 (APT41) / G1038 (UNC5221) / G1039 (UNC5325)".

17. Verizon DBIR 2024. "VPN Appliance Exploitation at Scale".

18. Ivanti. "Connect Secure Hardening Guide". 2024.

19. CISA. "Secure by Design Alert: VPN Appliance Security". 2024.

20. NIST. "SP 800-53 Rev. 5: SC-7, SC-18, SI-7 for Network Boundary Protection".

Corrections log — 1 September 2026: The paper reported "1,700+ organizations compromised globally" and attributed that unit to Volexity. Volexity counted compromised appliances, not organisations — "over 1,700 compromised Ivanti Connect Secure VPN devices" on 15 January 2024, revised to over 2,100 the next day. A single organisation may run several appliances, so the two are not interchangeable and the original figure overstated the number of affected organisations. Corrected throughout, with the revised 2,100 figure and an explicit note on units.

Corrections log — 2 September 2026: The paper cited Executive Order 13874 as the sanctions authority for Chinese state-sponsored activity. EO 13874 concerns the regulatory framework for agricultural biotechnology products; the applicable cyber authority is EO 13694, as amended by EO 13757. Corrected, with the clarification that no designation has been made in connection with this campaign. CISA Emergency Directive 24-01 was dated 17 January 2024 in two places; it was issued on 19 January 2024. Two further entries — an "FCC Emergency Guidance" and an NSA advisory said to carry a "classified annex for DIB" — could not be substantiated against any published source and have been removed rather than left standing as government directives.