Warning: New Malware Emerges in Attacks Exploiting Ivanti VPN Vulnerabilities

Google-owned Mandiant said it identified new malware employed by a China-nexus espionage threat actor known as UNC5221 and other threat groups during post-exploitation activity targeting Ivanti Connect Secure VPN and Policy Secure devices.
This includes custom web shells such as BUSHWALK, CHAINLINE, FRAMESTING, and a variant of LIGHTWIRE.
"CHAINLINE is a Python web shell backdoor that is

actor attacks china connect devices espionage exploitation exploiting google ivanti ivanti connect secure ivanti connect secure vpn ivanti vpn malware mandiant nexus policy post-exploitation secure devices secure vpn shells targeting threat threat actor threat groups vpn vulnerabilities warning web web shells