Loading malware…
SPAWNANT is a custom malware component in the SPAWN malware ecosystem used in intrusions against Ivanti Connect Secure appliances. It is consistently described as an installer module and has been deployed alongside other SPAWN components including SPAWNMOLE, a tunneling utility, SPAWNSNAIL, a passive backdoor, and SPAWNSLOTH, a log-tampering utility. Later reporting describes SPAWNWAVE as an evolved form of SPAWNANT that incorporates capabilities from other SPAWN-family components, and SPAWNCHIMERA as a broader framework combining functionality from SPAWNANT, SPAWNMOLE, and SPAWNSNAIL.
SPAWNANT has been associated with suspected China-nexus espionage activity, particularly clusters tracked as UNC5337 and UNC5221. These actors have been linked to exploitation of multiple Ivanti Connect Secure vulnerabilities, including CVE-2023-46805, CVE-2024-21887, CVE-2024-21893, CVE-2025-0282, and later SPAWN-related post-exploitation activity observed after exploitation of CVE-2025-22457. The malware has been used in campaigns targeting government entities and a broader set of sectors through compromises of edge appliances, with operators leveraging the access for follow-on intrusion activity inside victim environments.
As an installer within the SPAWN ecosystem, SPAWNANT supports post-exploitation deployment of additional tooling on compromised Ivanti devices rather than serving as the primary long-term access implant itself. Its operational role is closely tied to appliance compromise, staging of companion malware, and enabling subsequent tunneling, backdoor access, and anti-forensic actions performed by related SPAWN modules. High-confidence reporting supports its use on Ivanti Connect Secure appliances in espionage-oriented operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
UNC5337 leveraged multiple custom malware families including the SPAWNSNAIL passive backdoor, SPAWNMOLE tunneler, SPAWNANT installer, and SPAWNSLOTH log tampering utility.
UNC5337 leveraged multiple custom malware families including the SPAWNSNAIL passive backdoor, SPAWNMOLE tunneler, SPAWNANT installer, and SPAWNSLOTH log tampering utility.
CVE-2025-0282 (CVSS skóre 9,0) Kritická zraniteľnosť spočíva v pretečení zásobníka a vzdialený neautentifikovaný útočník by ju mohol zneužiť na vzdialené vykonanie kódu. CVE-2025-0282 je v súčasnosti aktívne zneužívaná na kompromitáciu Ivanti Connect Secure a následnú inštaláciu malvéru.
It includes multiple modules with diverse capabilities: SPAWNANT: Installer
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
UNC5337 leveraged multiple custom malware families including the SPAWNSNAIL passive backdoor, SPAWNMOLE tunneler, SPAWNANT installer, and SPAWNSLOTH log tampering utility.
UNC5337 leveraged multiple custom malware families including the SPAWNSNAIL passive backdoor, SPAWNMOLE tunneler, SPAWNANT installer, and SPAWNSLOTH log tampering utility.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Custom malware attributed to UNC5221, used in operations exploiting Ivanti zero-days against government agencies.
Custom malware used by UNC5221 in campaigns exploiting Ivanti zero-days against government agencies (functionality not described in the content).
Custom malware associated with UNC5221 activity, referenced in the context of Ivanti zero-day exploitation against government agencies.
Custom malware associated with UNC5221 activity, referenced in the context of Ivanti zero-day exploitation against government agencies.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.