# CISA Declares Emergency: Nation-State Actors Actively Exploiting Ivanti Remote Access Vulnerabilities
Federal agencies face a ticking clock after the Cybersecurity and Infrastructure Security Agency issued an emergency directive this week addressing critical flaws in Ivanti's widely deployed remote access platform. The mandated response reflects not just the severity of the vulnerabilities themselves, but the real-time threat posed by sophisticated adversaries already weaponizing them against American infrastructure.
## The Critical Vulnerabilities Driving Urgent Action
Two vulnerabilities discovered in early January have triggered the emergency response. CVE-2025-0282, rated 9.0 on the CVSS scale, represents a stack-based buffer overflow that permits unauthenticated attackers to achieve remote code execution—the most dangerous class of vulnerability. Its companion flaw, CVE-2025-0283, carries a 7.0 severity rating and enables privilege escalation on affected systems.
The distinction between these two vulnerabilities is significant. While the privilege escalation flaw requires some level of system access to exploit, the remote code execution vulnerability requires no authentication whatsoever. An attacker sitting anywhere on the internet with network access to an unpatched Ivanti appliance can gain complete control of the device without presenting any valid credentials.
What elevates this from a standard vulnerability disclosure to an emergency directive is the evidence that multiple threat actors are already exploiting these flaws in production environments. Mandiant's threat intelligence team has documented a Chinese nation-state-aligned group, tracked under the designation UNC5221, actively deploying custom malware against compromised Ivanti installations.
## Nation-State Threat Actors Already Operating
The involvement of state-sponsored attackers transforms the nature of the risk. UNC5221's exploitation of these vulnerabilities has been confirmed as ongoing, not theoretical. Security researchers have observed the group deploying two novel malware families specifically designed to establish durable access and exfiltrate sensitive information.
DRYHOOK operates as a credential harvesting tool, positioned on compromised appliances to intercept authentication traffic. By sitting between users and the authentication systems, it captures usernames, passwords, and other credentials as they traverse the device. This approach gives attackers a steady stream of valid credentials they can leverage across other systems and networks.
PHASEJAM takes a different approach, functioning as a persistent web shell that allows attackers to maintain access even after a victim organization performs a factory reset of the affected appliance. This is particularly alarming because factory resets are typically considered the nuclear option—wiping a device completely and restoring it to pristine condition. The ability to survive that process suggests the malware either embeds itself at a layer below the operating system or achieves persistence through other means that standard reset procedures fail to address.
## The 48-Hour Federal Mandate
Emergency Directive ED-25-02 establishes a compressed timeline that reflects the threat's severity. All Federal Civilian Executive Branch agencies must complete specific actions within 48 hours of issuance:
Agencies discovering evidence of compromise face additional mandatory steps. Rather than attempting to disinfect a compromised appliance, federal guidance requires a complete factory reset followed by reconstruction from known-clean configuration backups. All credentials must be rotated before the equipment returns to operational status.
This approach reflects a fundamental security principle: when dealing with sophisticated adversaries who may have embedded persistent access mechanisms, attempting remediation is often futile. Complete replacement of the system state becomes the only reliable recovery path.
## A Massive Exposure Landscape
The scope of Ivanti's installed base creates a significant attack surface. Security scanning firm Censys identified more than 22,000 instances of Ivanti Connect Secure exposed to the internet globally. Within the United States specifically, approximately 3,600 instances are directly reachable from external networks.
That global number likely represents only a fraction of total deployments. Many organizations operate these devices behind firewalls and other network perimeter controls, making them invisible to external scanning. Even organizations without internet-facing Ivanti appliances may face risk if they use the products for internal remote access purposes.
The installed base encompases both Connect Secure and Policy Secure product families, both vulnerable to the same critical flaws.
## Security Leadership's Stark Assessment
CISA Director Jen Easterly underscored the urgency in public comments on the directive: "This is not a situation where agencies can wait for a convenient maintenance window. We are seeing active, ongoing exploitation by sophisticated threat actors. Disconnect first, then patch."
This guidance departs from standard patching procedures. Normally, organizations schedule patches during planned maintenance windows to minimize service disruption. In this case, CISA is explicitly telling federal agencies that tolerating downtime is preferable to risking compromise. The only acceptable reason to delay patching is when the device must first be disconnected for forensic investigation to determine whether it's already been compromised.
## Implications for Organizations Beyond Federal Government
While the directive applies specifically to federal civilian agencies, the vulnerabilities affect Ivanti customers across the private sector, critical infrastructure operators, and international organizations. CISA's public disclosure of the directive, including the malware signatures and exploitation indicators, serves as a de facto warning to all organizations relying on Ivanti's remote access products.
Organizations should treat this with urgency comparable to the federal government, even without the mandated timeline. The combination of a 9.0-severity remote code execution vulnerability and confirmed nation-state exploitation creates conditions where compromise can occur rapidly and persist through conventional remediation attempts.
## HackWire Analysis
This emergency directive illustrates how vulnerabilities in widely deployed infrastructure products can amplify across entire sectors simultaneously. Ivanti's market position means a single flaw affects thousands of organizations, and the confirmation of nation-state exploitation removes any hope that this vulnerability might remain unexploited for months. The emphasis on disconnection and factory reset, rather than in-place patching, signals extraordinary confidence in the adversary's capabilities to hide within the running system. Organizations operating Ivanti devices should assume they're in a race: patch before compromise occurs, and if indicators of exploitation appear, treat the situation as a complete system failure requiring full replacement and credential rotation rather than remediation.