#unc5325
1 case
Ivanti Connect Secure Mass Exploitation (CVE-2024-21893, CVE-2024-21887): Chinese APT VPN Appliance Compromise at ScaleState-SponsoredSupply Chain Attack
In January 2024, multiple Chinese APT clusters (UNC5221, UNC5325) exploited two zero-day vulnerabilities in Ivanti Connect Secure VPN appliances — CVE-2024-21893 (SAML authentication bypass) and CVE-2024-21887 (command injection) — compromising 1,700+ organizations globally in one of the largest VPN appliance exploitation campaigns to date.
State-SponsoredSupply Chain Attack