Ivanti VPN Flaws Exploited by Chinese Hackers Impacting Almost 120 Organizations, Report Says
Published
Key Takeaways
- Historic Breach: Reports indicate Chinese state-sponsored actors exploited Ivanti's Pulse Secure VPN to infiltrate U.S. networks.
- Widespread Impact: A vulnerability reportedly allowed unauthorized access to at least 119 organizations, including critical infrastructure and government contractors.
- Prolonged Access: Cited sources said the attackers planted a backdoor leveraging preexisting vulnerabilities in Pulse Secure’s VPN as early as 2021.
Chinese hackers exploited critical Ivanti VPN flaws to compromise dozens of high-value targets in a sophisticated cyberespionage campaign. The breach, which reportedly began in February 2021, targeted Pulse Secure VPN appliances, a staple in enterprise and government network security.Â
Scope of the Chinese Hackers Breach
While initially targeting a subsidiary, the Chinese hacker breach expanded to compromise at least 119 organizations, including U.S. and European military contractors, a Bloomberg report says.
Threat actors reportedly leveraged a zero-day vulnerability and used the backdoor to gain access to the unnamed organizations, the report said, citing sources, including Ivanti’s chief security officer at the time. Yet, an Ivanti spokesperson disputed this claim.
Mandiant, a leading threat intelligence firm, was reportedly aware of the exploitation vectors and alerted Ivanti. However, questions remain regarding the timeliness of remediation and the efficacy of the patches deployed during the active exploitation window.Â
Cybersecurity in VPNs
Security professionals must prioritize patch management and consider the supply chain risks associated with vendor acquisitions.
In a rare move, on February 1, 2024, CISA mandated that all federal civilian executive branch agencies disconnect all Ivanti VPN appliances by the next day due to flaws active exploitation.
Reports last month revealed that two Ivanti zero-days were actively exploited in global cyberattacks targeting government organizations. The CVE-2025-22457 Ivanti Connect Secure VPN flaw was reported as under active exploitation by a suspected China-nexus threat actor in April 2025.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular