Chinese nexus APT UNC5221 exploited chained zero-days in Ivanti Connect Secure VPN gateways starting Dec 2023, publicly disclosed Jan 10 2024 by Volexity. CVE-2023-46805 (auth bypass) + CVE-2024-21887 (command injection) allowed unauthenticated RCE. CISA itself was compromised via connected Ivanti products. Thousands of devices globally affected. Multiple custom malware families deployed. Ivanti’s initial integrity checker tool had a bypass. Patches took weeks to issue. State and local government agencies, defense contractors heavily targeted.