Loading malware…
SPAWNSLOTH is a log-tampering malware component targeting Linux-based Ivanti Connect Secure VPN appliances. Part of the SPAWN malware ecosystem, it conceals malicious activity by suppressing appliance logging. It targets the dslogserver process to disable local logging and remote syslog forwarding, supporting covert operation of the associated SPAWNSNAIL SSH backdoor.
SPAWNSLOTH has been deployed by UNC5337 and observed in intrusions associated with UNC5221, both tracked as China-nexus espionage clusters. Its deployment occurs after compromise of Ivanti appliances, including campaigns exploiting CVE-2025-0282. It functions as a defense-evasion component rather than an initial-access mechanism or standalone remote-access implant.
SPAWNCHIMERA drops SPAWNSLOTH, and a variant is also incorporated into the RESURGE implant. Updated SPAWNSLOTH samples retain substantially the same functionality as earlier versions but remove debugging-message functions, reducing artifacts useful for analysis and threat hunting. A RESURGE-associated variant has been identified on a compromised critical-infrastructure organization's Ivanti appliance.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2025-0282, a zero-day vulnerability, has been exploited since December 2024, enabling unauthenticated remote code execution. | SPAWNSLOTH /tmp/.liblogblock.so Log tampering utility
The earliest evidence of observed CVE-2025-22457 exploitation occurred in mid-March 2025. Following successful exploitation, we observed the deployment of two newly identified malware families, the TRAILBLAZE in-memory only dropper and the BRUSHFIRE passive backdoor.
UNC5221 is a suspected China-nexus actor that Mandiant is tracking as the only group exploiting CVE-2023-46805 and CVE-2024-21887 during the pre-disclosure time frame since early Dec. 2023.
UNC5330 has been observed chaining CVE-2024-21893 and CVE-2024-21887 to compromise Ivanti Connect Secure VPN appliances as early as Feb. 2024. Post-compromise activity by UNC5330 includes deployment of PHANTOMNET and TONERJAM.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
SPAWNSLOTH acts as a log tampering component tied to the SPAWNSNAIL backdoor.
UNC5337 leveraged SPAWNSLOTH as a log tampering utility.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware/tooling family referenced here as a variant used to tamper with logs on compromised systems to hinder detection and incident response.
Referenced as a malware/tool variant (liblogblock.so) used alongside RESURGE to tamper with logs on compromised Ivanti Connect Secure devices, supporting stealth and defense evasion.
A SPAWN-family log-tampering utility used to erase or manipulate Ivanti device logs to remove evidence of compromise and hinder incident response/forensics.
Log-tampering component/variant embedded within the RESURGE sample, used to interfere with Ivanti device logging.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.