Loading malware…
SPAWNSNAIL is a custom SSH backdoor within the SPAWN malware ecosystem used in intrusions targeting Ivanti Connect Secure VPN appliances. It has been associated with suspected China-nexus espionage activity, particularly clusters tracked as UNC5337 and more broadly UNC5221. The malware has been deployed following exploitation of critical Ivanti Connect Secure vulnerabilities including CVE-2023-46805, CVE-2024-21887, CVE-2024-21893, CVE-2025-0282, and CVE-2025-22457 in campaigns affecting organizations across multiple countries and sectors such as government, telecommunications, finance, chemical, automotive, energy, and defense.
SPAWNSNAIL functions as a passive backdoor that provides covert remote access on compromised edge appliances. It is commonly used alongside other SPAWN components that provide installation, tunneling, and anti-forensic support, including SPAWNANT, SPAWNMOLE, and SPAWNSLOTH. SPAWNSLOTH is tied to SPAWNSNAIL and is used to tamper with logging, including disabling local logging and remote syslog forwarding, which supports defense evasion and complicates incident response. The broader SPAWN toolkit has been used to maintain access on compromised Ivanti devices and to facilitate follow-on post-exploitation activity, including pivoting from the appliance into internal networks.
Operationally, SPAWNSNAIL appears tailored for appliance-focused espionage operations in which attackers first obtain code execution on exposed VPN infrastructure and then establish covert persistence and remote access. Its use in conjunction with tunneling and log-manipulation modules indicates a design optimized for stealthy long-term access, traffic relay, and concealment on network edge systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
UNC5337 leveraged multiple custom malware families including the SPAWNSNAIL passive backdoor, SPAWNMOLE tunneler, SPAWNANT installer, and SPAWNSLOTH log tampering utility.
UNC5337 leveraged multiple custom malware families including the SPAWNSNAIL passive backdoor, SPAWNMOLE tunneler, SPAWNANT installer, and SPAWNSLOTH log tampering utility.
It includes multiple modules with diverse capabilities: SPAWNSNAIL: SSH backdoor
It includes multiple modules with diverse capabilities: SPAWNSNAIL: SSH backdoor
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
UNC5337 leveraged multiple custom malware families including the SPAWNSNAIL passive backdoor, SPAWNMOLE tunneler, SPAWNANT installer, and SPAWNSLOTH log tampering utility.
UNC5337 leveraged multiple custom malware families including the SPAWNSNAIL passive backdoor, SPAWNMOLE tunneler, SPAWNANT installer, and SPAWNSLOTH log tampering utility.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
SPAWNSNAIL is an SSH backdoor targeting Ivanti devices. It has an ability to inject a specified binary to other process, running local SSH backdoor when injected to dsmdm process, as well as injecting additional malware to dslogserver
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.