CVE-2025-0282: Ivanti Connect Secure Zero-Day Exploited by Nation-State Hackers Before Anyone Knew It Existed

TL;DR: CVE-2025-0282 is a critical stack-based buffer overflow in Ivanti Connect Secure VPN with CVSS 9.0, enabling pre-authentication RCE. Exploited as a zero-day by China-nexus threat actor UNC5337 since mid-December 2024 — weeks before disclosure on January 8, 2025. SPAWN malware ecosystem deployed (DRYHOOK, PHASEJAM, SPAWNANT, SPAWNMOLE, SPAWNSNAIL). CISA issued Emergency Directive 25-01. Patch to ICS 22.7R2.5 or isolate immediately.

Ivanti Connect Secure (formerly Pulse Secure VPN) has been at the center of some of the most significant cyber espionage campaigns in recent history. After critical zero-days in early 2024 (CVE-2024-21887, CVE-2023-46805), enterprises rushed to patch and regain confidence. Less than a year later, CVE-2025-0282 arrived: another critical pre-authentication RCE zero-day in the same product, again exploited by sophisticated nation-state actors for weeks before anyone knew it existed.

This is the complete technical analysis: the vulnerability, the extraordinarily sophisticated malware ecosystem deployed by attackers, attribution evidence, CISA’s emergency response, and how to detect and recover from compromise.

Vulnerability Overview

The Vulnerability: Stack Buffer Overflow in a VPN Appliance

Ivanti Connect Secure is a widely deployed SSL VPN solution used by governments, financial institutions, healthcare systems, and enterprises worldwide. By design, it is exposed to the internet — the gateway between remote users and corporate networks. This makes it an extremely high-value target for threat actors seeking persistent access to enterprise environments.

CVE-2025-0282 is a stack-based buffer overflow in ICS’s web server component. When the VPN appliance receives specially crafted HTTP requests to specific API endpoints, it fails to properly validate input size before copying data into a fixed-size stack buffer.

In a stack buffer overflow attack:

1. The attacker sends data that exceeds the stack buffer’s allocated size
2. The overflow overwrites adjacent stack memory, including the return address of the current function
3. By carefully crafting the payload, the attacker overwrites the return address to point to their shellcode or a ROP (Return-Oriented Programming) chain
4. When the function returns, execution jumps to the attacker’s code, running as root on the appliance

Affected Versions

Nation-State Exploitation and the SPAWN Ecosystem

The zero-day exploitation was attributed to threat actors UNC5337 and UNC5221 by Mandiant (Google Cloud), assessed as China-nexus state-sponsored groups linked to previous Ivanti exploitation campaigns in 2024. Exploitation began in mid-December 2024 — over three weeks before public disclosure.

The malware ecosystem deployed was extraordinarily sophisticated, clearly purpose-built for long-term persistence on Ivanti appliances:

DRYHOOK — Credential Harvester

DRYHOOK hooks directly into ICS’s VPN authentication process to capture credentials in real-time. Every time a legitimate employee authenticates to the corporate VPN, DRYHOOK captures their username and password and sends them to the attackers. A single compromised VPN gateway becomes a credential phishing operation targeting an entire organization’s remote workforce — silently, continuously, for as long as the implant remains active.

PHASEJAM — Disguised Web Shell

PHASEJAM is a web shell that doesn’t act like a typical web shell. Instead of creating a new, obviously suspicious PHP file, it modifies existing legitimate ICS files — appearing in file listings as known-good components of the Ivanti Connect Secure system. PHASEJAM intercepts specific legitimate ICS web requests and provides its own responses while still serving legitimate ICS content to legitimate users, making it nearly invisible to both file-based detection and behavioral monitoring by administrators.

SPAWN Ecosystem — Persistent Implant Framework

The SPAWN framework is a multi-component implant system designed specifically for Ivanti Connect Secure persistence:

• SPAWNANT (Installer): The most dangerous component. SPAWNANT modifies Ivanti’s firmware upgrade process itself — ensuring that DRYHOOK, PHASEJAM, and other SPAWN components are automatically reinstalled after any firmware upgrade or factory reset. This makes the compromise persist even if the organization applies patches or factory resets the device, which is the recommended remediation step.
• SPAWNMOLE (Tunneler): A SOCKS5 tunneling tool that creates covert communication channels, allowing attackers to proxy traffic through the compromised VPN device into the internal network without triggering perimeter security controls
• SPAWNSNAIL (SSH Backdoor): An SSH backdoor providing persistent remote shell access to the ICS device, completely independent of the VPN software’s authentication system
• HARDHAT: An HTTPS-based C2 framework for controlling SPAWNSNAIL

Full Attack Chain

1. Stack buffer overflow via CVE-2025-0282 → unauthenticated root shell on ICS appliance
2. Deploy PHASEJAM (disguised web shell for persistent C2) and DRYHOOK (credential harvester)
3. Deploy SPAWN framework: SPAWNANT modifies upgrade scripts, SPAWNMOLE creates tunnels, SPAWNSNAIL installs SSH backdoor
4. SPAWNANT ensures all backdoors survive future patches and factory resets
5. SPAWNMOLE tunnels allow network reconnaissance and lateral movement into the internal network
6. Credentials captured by DRYHOOK are used to authenticate to internal systems as legitimate users
7. Sensitive data exfiltrated through SPAWNMOLE tunnel

CISA Emergency Directive 25-01

The severity led CISA to issue Emergency Directive 25-01 on January 13, 2025, requiring all US Federal Civilian Executive Branch (FCEB) agencies to:

1. Immediately disconnect all Ivanti Connect Secure and Policy Secure devices
2. Run Ivanti’s Integrity Checker Tool (ICT) on disconnected devices
3. Perform a factory reset before reconnecting
4. Apply available patches after factory reset
5. Hunt for compromise indicators in network logs from the previous 90 days

Emergency directives from CISA are rare and signal the highest urgency. Any organization running Ivanti Connect Secure should follow the same guidance.

Detection

# Run Ivanti's Integrity Checker Tool (ICT) from admin console:
# System > Maintenance > Integrity Checker Tool
# NOTE: PHASEJAM modifies legitimate files, which may reduce ICT effectiveness

# Additional manual checks via SSH to admin interface:

# Look for unexpected cron jobs
crontab -l

# Check for unusual processes
ps auxww | grep -v "[kthread]" | sort -k 11

# Recently modified files in web directories (90 day window)
find /home/webserver -newer /home/webserver/cgi-bin/sslvpn -type f -mtime -90 2>/dev/null

# Check for unexpected listening services
netstat -tlnp

Network-based hunting:

• Unusual outbound connections from the ICS appliance management IP to non-Ivanti infrastructure
• HTTPS traffic from the appliance to unrecognized external IPs
• Unexpected SSH connections involving the appliance management IP
• Large data transfers at unusual hours from the appliance
• Impossible travel or unusual access patterns for VPN users (DRYHOOK may have captured credentials)

Remediation Steps

1. Isolate immediately: Disconnect the ICS appliance from the internet — do not assume patching alone is sufficient if the window of exposure overlaps with known exploitation timeframes
2. Preserve evidence: Before any reset, copy system logs and web server access logs for forensic analysis
3. Factory reset: SPAWNANT’s persistence mechanism means a simple patch may not remove backdoors — a factory reset is required before applying patches on any potentially compromised device
4. Apply patches: ICS → 22.7R2.5; Policy Secure → 22.7R1.2; ZTA → 22.8R2.2
5. Rotate all credentials: Assume all VPN user credentials captured by DRYHOOK are compromised. Force password resets for all users who authenticated through the device in the 90 days before patching — especially domain admin and service accounts
6. Hunt for lateral movement: Review authentication logs on all internal systems for suspicious activity correlated with the compromise period

Why VPN Devices Are Persistently Targeted

CVE-2025-0282 is the latest in a pattern of nation-state attacks against VPN infrastructure. The strategic value is clear:

• VPN devices are always internet-exposed — there is no way to put them behind another security layer
• They are trusted by everything on the internal network
• They process every remote user’s authentication — a single compromise yields thousands of credentials
• Traditional EDR tools don’t run on VPN appliances
• Patch cycles for network appliances are typically slower than for endpoints

Conclusion

CVE-2025-0282 demonstrates the cutting edge of state-sponsored cyber operations: a zero-day buffer overflow in critical network infrastructure, exploited for weeks before disclosure, with a malware ecosystem specifically engineered to survive remediation attempts. The SPAWN framework that persists through factory resets represents a new high-water mark for attacker sophistication against network appliances.

If you operate Ivanti Connect Secure, follow CISA ED 25-01 guidance: isolate, factory reset, patch, rotate credentials, and hunt for lateral movement. For professional incident response services or VPN infrastructure security assessments, contact Vivek Verma.

VPN devices are the front door to your network. Make sure nation-state adversaries cannot walk right through them.