UNC5221 has a knack for exploiting defects in Ivanti products. The group has exploited at least four vulnerabilities in the vendor’s products since 2023, according to Mandiant.

The Chinese state-backed espionage group started targeting third-party IT services in late 2024, Microsoft researchers said.

The most consequential cyberattacks observed by Darktrace last year were linked to software defects in firewalls and perimeter network technologies.

After Ivanti detected the activity, Mandiant says it found malware in impacted devices associated with a Chinese-linked threat group.

Ivanti's Cloud Service Appliance has a "high severity vulnerability" being exploited in the wild.

Information sharing between the private sector and the federal government is providing a leg up when responding to vulnerabilities.

The software company pushed back on the joint advisory, which comes following multiple directives from CISA this year prodding agencies to patch against Ivanti exploits.

An updated emergency directive includes instructions on how to bring affected devices back online securely.

The agency says the bug is being actively exploited and poses a risk to federal networks.