Picus Security UNC5221 Ivanti May 2025

SPAWNCHIMERA has extracted the device’s Linux kernel image (vmlinux).

SPAWNCHIMERA has encoded a private key with XOR. SPAWNCHIMERA has also encrypted data to be extracted using AES encryption.

DRYHOOK has encrypted stolen credentials strings within a file using both Base64 and RC4 with a hard-coded key.

BRUSHFIRE has the ability to exfiltrate data on-demand through executing commands obtained via monitoring for specially crafted packets and sending output back in an embedded SSL response.

TRAILBLAZE has injected a hook into an existing process to load BRUSHFIRE in the spaces allocated memory to include the Ivanti Connect Secure (ICS) web process named `web`.

DRYHOOK has captured user credentials and passwords in plaintext and has encrypted them in a stored file on the network device.

TRAILBLAZE has conducted process discovery by searching for specific named processes such as `/home/bin/web`.

DRYHOOK is a Python-based script that executes within the victim environment.

DRYHOOK has the ability to interact with Ivanti Connect Secure environments and to modify system components.

TRAILBLAZE has the ability to delete temporary files and contents in specified directories to cover its tracks.

DRYHOOK has stored stolen credentials for future use in the temp folder of a victimized Ivanti Connect Secure VPN device, specifically in the file location `/tmp/cmmmap.kumMW`.

TRAILBLAZE has leveraged raw syscalls to execute commands.

BRUSHFIRE has monitored inbound VPN traffic to compromised appliances until specific inbound packets contain a specific magic string/pattern instead of external beaconing.

DRYHOOK has the ability to remount the filesystem as “read-write” to make changes and then restores it to “read-only” prior to killing processes to apply the modifications.

DRYHOOK has intercepted and logged user credentials by modifying the Perl module in Ivanti Connect Secure VPN edge-devices located within `/home/perl/DSAuth.pm`.

DRYHOOK has modified the Ivanti Connect Secure VPN authentication Perl module `DSAuth.pm` by reading its contents in the buffer, then finding and replacing select lines of code.

BRUSHFIRE has executed its commands within memory and is not saved on disk.

SPAWNCHIMERA has modified the Ivanti Integrity Checker Tool to evade detection.

SPAWNCHIMERA has disabled logging and log forwarding on Ivanti devices targeting the `dslogserver` process.