UNC5221 (Ivanti exploitation) threat actor profile: Edge device credential theft, detection and recovery

UNC5221 breaks in through VPN and remote access appliances that cannot run endpoint detection, then harvests the passwords, sessions and directory secrets that pass through them. Mandiant (Google Threat Intelligence Group) tracks the cluster as a suspected China-nexus espionage actor that has exploited zero-days in Ivanti Connect Secure since December 2023 and in Citrix NetScaler before that, and in 2025 tied it to the long-dwell BRICKSTORM intrusions against legal, SaaS and technology firms. This profile summarises who the group is, what it targets, the ATT&CK techniques MITRE records for its Ivanti campaign, how it abuses identities and credentials, and the detection and recovery steps that matter most. It does not describe exploitation mechanics. It is written for network, identity and incident response teams that operate edge appliances, vCenter and Entra ID.

Key takeaways

• Edge zero-days are its habit. GTIG reports UNC5221 exploiting CVE-2023-46805 and CVE-2024-21887, CVE-2025-0282 and CVE-2025-22457 in Ivanti products and CVE-2023-4966 in Citrix NetScaler, and expects it to keep pursuing edge device zero-days.
• The appliance becomes a credential harvester. The WARPWIRE JavaScript injected into the Ivanti login page captured plaintext usernames and passwords, including logins for applications such as RDP published through the gateway.
• Stored secrets leak too. Mandiant found a patched system binary that disabled redaction in configuration dumps, so service account passwords, API keys and certificates held on the appliance must be treated as exposed.
• Identity infrastructure is the second target. In BRICKSTORM intrusions the actor captured vCenter logins, cloned domain controllers, SSO identity providers and secret vaults to extract ntds.dit, and created Entra ID enterprise applications with mail.read or full_access_as_app to read any mailbox.
• Recovery means rotating everything the device touched. Patch or rebuild, run the internal then external Integrity Checker Tool, reset local and user credentials, reset API keys and revoke certificates, then hunt for secondary access.

Who they are (names and aliases)

UNC5221 is Mandiant's designation for a suspected China-nexus espionage cluster; "UNC" marks an uncategorised group. MITRE ATT&CK v20 has no group entry for it, but records the Ivanti campaign as C0029 Cutting Edge, which it describes as conducted by suspected China-nexus espionage actors variously identified as UNC5221/UTA0178 and UNC5325, beginning as early as December 2023. UTA0178 is Volexity's name for the actor it observed exploiting the same Ivanti zero-days.

In its September 2025 BRICKSTORM report GTIG attributes that activity to UNC5221 and closely related, suspected China-nexus clusters, and notes that although UNC5221 has been used synonymously with Silk Typhoon in public reporting, GTIG does not currently consider them the same cluster. See the Silk Typhoon Threat Actor Profile Guide and the China State Cyber Operations Guide. Mandiant also stresses that after disclosure many actors used the Ivanti exploits, so not every WARPWIRE variant is attributed to UNC5221.

Targeting and motivation

The objective is espionage and long-term access. ATT&CK records Cutting Edge targeting the US defence industrial base and sectors globally including telecommunications, finance, aerospace and technology. GTIG's BRICKSTORM reporting adds legal services (likely for information on US national security and international trade), SaaS providers (for access to downstream customers, assessed with high confidence), business process outsourcers and technology companies (for intellectual property that supports zero-day development), mainly in the United States, with an average dwell time of 393 days.

Tactics and techniques (MITRE ATT&CK)

The first part of the table lists techniques ATT&CK v20 records for campaign C0029 Cutting Edge. The last rows are our mapping of GTIG's BRICKSTORM findings, checked against ATT&CK v20.

How they abuse identities and credentials

• Login page capture: because users and administrators sign in through the VPN portal, an implant there collects domain credentials at scale. Mandiant recommends resetting the password of every user who authenticated while WARPWIRE was active.
• Appliance secrets: the patched dsls binary exposed values normally redacted in configuration and cache dumps. Treat LDAP bind accounts, RADIUS secrets, API keys, local admin accounts and certificates stored on the appliance as compromised non-human identities. See the Ivanti Connect Secure Hardening and Integrity Checking Guide.
• Session camouflage: the FRAMESTING web shell read commands from a cookie named DSID, the same name Ivanti uses for VPN session tracking, to blend in with normal traffic.
• Directory takeover: with harvested domain credentials the actor dumped LSASS and extracted the Active Directory database, which gives every domain account's password hash, including service accounts.
• Virtualisation and vaults: GTIG documents cloning of domain controllers, SSO identity providers and secret vaults without powering the clones on, so security tools never ran, and in one case use of admin credentials against a Delinea Secret Server. Credential vaults are Tier 0 and must be protected as such. See the VMware vCenter Server Hardening Guide.
• Cloud application identities: enterprise applications with application permissions to mail read every mailbox without any user signing in, a quiet NHI-based persistence method. See the Entra ID Applications and Consent Guide.

Notable incidents

• Ivanti Connect Secure, December 2023 to early 2024: zero-day exploitation that became mass exploitation after disclosure; our analysis is Ivanti Connect Secure Exploitation 2024.
• CVE-2025-22457, March 2025: exploitation of unpatched appliances weeks after a fix shipped, followed by TRAILBLAZE, BRUSHFIRE and the SPAWN malware family, including SPAWNSLOTH, which disables local logging and syslog forwarding.
• BRICKSTORM, 2025: long-dwell intrusions in US legal, SaaS, BPO and technology organisations, pivoting from appliances to VMware and Microsoft 365. See the BRICKSTORM Backdoor Guide.

Detection and defence

Appliance integrity and logs

• Run both integrity checks: run Ivanti's internal Integrity Checker Tool first, then the external ICT, which is harder to tamper with, and share results with Ivanti.
• Watch the event IDs Mandiant lists: SYS32039 to SYS32042 and SYS32087 to SYS32088 for integrity checker results, and ADM20599 for log clearing.
• Alert on silent appliances: SPAWNSLOTH stops syslog forwarding, so a gap in appliance logs is itself a signal.
• Look for crash artefacts: GTIG advises monitoring for core dumps related to the web process and investigating ICT statedump files.
• Check client certificates: run anomaly detection on client TLS certificates presented to the appliance.

Identity hunting

Recover

1. Isolate the appliance, collect evidence off-box, then patch or rebuild it from a known-good image following the vendor's guidance.
2. Reset passwords for all local appliance accounts and for every user who authenticated while the harvester may have been active.
3. Reset API keys, LDAP and RADIUS service account passwords and other secrets stored on the appliance, and revoke and reissue its certificates.
4. If domain credential dumping is suspected, follow an Active Directory compromise recovery plan, including service accounts and the krbtgt account.
5. Remove unauthorised enterprise applications and credentials added to service principals, and review vCenter for clones and new accounts.

See the Edge Device Compromise Investigation Playbook.

Harden

• Patch edge appliances on a KEV-driven clock and replace end-of-life versions such as Ivanti Connect Secure 9.x.
• Restrict appliance management interfaces and limit appliances' own internet and internal access to what they need.
• Require phishing-resistant MFA behind the VPN for administrators, so a captured password alone is not enough.
• Follow vSphere hardening: forward logs to a SIEM, lockdown mode, MFA for web logins and execInstalledOnly, as GTIG recommends.
• Treat credential vault servers as Tier 0 and protect their encryption keys with a TPM.

Metrics

• Median days from KEV listing to patch for edge appliances.
• Percentage of edge appliances whose logs reached the SIEM in the last 24 hours.
• Number of secrets stored on edge appliances, and percentage rotated after each appliance incident.
• Number of enterprise applications with tenant-wide mail permissions, each with a documented owner.
• Number of vCenter clone operations on Tier 0 virtual machines not matched to a change record (target zero).

Framework mapping

Practitioner checklist

• Confirm every Ivanti Connect Secure and Citrix NetScaler appliance is on a fixed version for the CVEs in this profile.
• Run the internal and external Integrity Checker Tool and alert on the Mandiant-listed event IDs.
• List every secret, service account and certificate stored on each edge appliance and plan their rotation.
• Alert when an appliance stops sending logs.
• Hunt for appliance-originated Windows logons, Tier 0 VM clones and new vCenter accounts.
• Audit Entra ID enterprise applications with mail.read or full_access_as_app permissions.
• Prepare an Active Directory compromise recovery plan that covers service accounts and krbtgt.
• Treat secret vaults as Tier 0 in access, monitoring and backup design.

Standards and references

• Google Cloud (Mandiant): Cutting Edge, Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation
• Google Cloud (Mandiant): Cutting Edge, Part 2, Investigating Ivanti Connect Secure VPN Zero-Day Exploitation
• Google Cloud (GTIG): Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457)
• Google Cloud (GTIG): Another BRICKSTORM, Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors
• MITRE ATT&CK: Cutting Edge (C0029)
• MITRE ATT&CK: Input Capture: Web Portal Capture
• CISA: Known Exploited Vulnerabilities Catalog
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Ivanti Connect Secure Exploitation 2024 · Edge Device Exploitation by Threat Actors Guide · BRICKSTORM Backdoor Guide · VMware ESXi Hardening Guide · Threat Actor Groups Guide