SPAWNCHIMERA Malware: The Chimera Spawning from Ivanti Connect Secure Vulnerability
blogs.jpcert.or.jp · Undated · Licence: not cleared; local research copy only
CVEs this report names
2 CVEs- CVE-2025-0282Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow VulnerabilityIvanti · Connect Secure, Policy Secure, and ZTA GatewaysKEVRansomwarePublic exploitCritical · 9.0T1595Active ScanningT1190Exploit Public-Facing Application+4 more · 2 reports>99.9%Top 0.02%85.4priority
- CVE-2025-0283A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version…Ivanti · Connect SecureHigh · 7.02 reports17.5%Top 2.9%78.5priority
Where it names them
CVE-2025-0282 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
In January 2025, Ivanti published an advisory regarding the vulnerability CVE-2025-0282 in Ivanti Connect Secure.
Function to fix vulnerability CVE-2025-0282
SPAWNCHIMERA has a new function to fix the CVE-2025-0282 vulnerability.
CVE-2025-0282 is a buffer overflow vulnerability caused by the strncpy function, and the malware dynamically fixes it by hooking the strncpy function and limiting the copy size to 256.
Security Advisory Ivanti Connect Secure, Policy Secure & ZTA Gateways (CVE-2025-0282, CVE-2025-0283)
CVE-2025-0283 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
Security Advisory Ivanti Connect Secure, Policy Secure & ZTA Gateways (CVE-2025-0282, CVE-2025-0283)
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283?language=en_US
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.