After Ivanti detected the activity, Mandiant says it found malware in impacted devices associated with a Chinese-linked threat group.