Researchers Identify Multiple China Hacker Groups Exploiting Ivanti Security Flaws

Multiple China-nexus threat actors have been linked to the zero-day exploitation of three security flaws impacting Ivanti appliances (CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893).
The clusters are being tracked by Mandiant under the monikers UNC5221, UNC5266, UNC5291, UNC5325, UNC5330, and UNC5337. Another group linked to the exploitation spree is UNC3886.
The Google Cloud

china clusters cve cve-2023-46805 cve-2024 cve-2024-21887 cve-2024-21893 exploitation exploiting flaws google hacker hacker groups identify ivanti ivanti security mandiant nexus researchers security security flaws threat threat actors unc3886 under zero-day