S9024: SPAWNCHIMERA
SPAWNCHIMERA is a backdoor that supports command and control and can inject malicious components into native processes.[1][2][3] SPAWNCHIMERA It incorporates capabilities from multiple tools within the SPAWN malware family, including SPAWNANT, SPAWNMOLE, and SPAWNSNAIL.[4][2][3] SPAWNCHIMERA was first reported in April 2024.[2] SPAWNCHIMERA has been observed in activity attributed to People's Republic of China (PRC) state-sponsored threat actors, including UNC5221..[4][5][2][6]
Security context for executives and security teams
S9024: SPAWNCHIMERA describes [SPAWNCHIMERA](https://attack.mitre.org/software/S9024) is a backdoor that supports command and control and can inject malicious components into native processes.(Citation: CISA SPAWNCHIMERA RESURGE February 2026)(Citation: Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024)(Citation: JPCERT SPAWNCHIMERA Ivanti February 2025) [SPAWNCHIMERA](https://attack.mitre.org/software/S9024) It incorporates capabilities from multiple tools within the SPAWN malware family, including SPAWNANT, SPAWNMOLE, and SPAWNSNAIL.(Citation...
Executive priority
S9024: SPAWNCHIMERA is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate S9024: SPAWNCHIMERA by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Linux, Network Devices), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
- Network, endpoint, and security-tool telemetry
Detection direction
- Validate whether S9024: SPAWNCHIMERA appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
SPAWNCHIMERA
SPAWNCHIMERA is a backdoor that supports command and control and can inject malicious components into native processes.[1][2][3] SPAWNCHIMERA It incorporates capabilities from multiple tools within the SPAWN malware family, including SPAWNANT, SPAWNMOLE, and SPAWNSNAIL.[4][2][3] SPAWNCHIMERA was first reported in April 2024.[2] SPAWNCHIMERA has been observed in activity attributed to People's Republic of China (PRC) state-sponsored threat actors, including UNC5221..[4][5][2][6]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1140 | Deobfuscate/Decode Files or Information | SPAWNCHIMERA has decoded a XOR encoded private key.[3] |
| Enterprise | T1057 | Process Discovery | SPAWNCHIMERA has searched for running processes to include web or dsmdm.[1][2] |
| Enterprise | T1678 | Delay Execution | SPAWNCHIMERA has used delayed execution to pause for a defined interval before performing environment discovery, repeatedly checking for specific processes, such as the `dslogserver` process, prior to continuing execution. [1] |
| Enterprise | T1505.003 | Web ShellSub-technique | SPAWNCHIMERA has created web shells that facilitate actions on the victim host.[1] |
| Enterprise | T1574 | Hijack Execution Flow | SPAWNCHIMERA can persist across system upgrades by hijacking the execution flow of dspkginstall, a binary used during the system upgrade process.[4][2] |
| Enterprise | T1037 | Boot or Logon Initialization Scripts | SPAWNCHIMERA has modified the boot process files within `/tmp/coreboot_fs/bin/init` to establish persistence.[1] |
| Enterprise | T1518.001 | Security Software DiscoverySub-technique | SPAWNCHIMERA has checked where SELinux is enabled on the targeted host.[2] |
| Enterprise | T1005 | Data from Local System | SPAWNCHIMERA has extracted the device’s Linux kernel image (vmlinux).[1][5][6] |
| Enterprise | T1572 | Protocol Tunneling | SPAWNCHIMERA has created SSH tunnels to facilitate C2 communications.[1][4][2] |
| Enterprise | T1059.006 | PythonSub-technique | SPAWNCHIMERA has searched the contents of two Python files scanner.py and scanner_legacy.py by searching for specific lines and replacing them with values that reduce their ability to track mismatches or new files.[1] |
| Enterprise | T1574.006 | Dynamic Linker HijackingSub-technique | SPAWNCHIMERA has been compiled as a Position Independent Executable (PIE) to use a third-party library for injection.[2] |
| Enterprise | T1027.013 | Encrypted/Encoded FileSub-technique | SPAWNCHIMERA has encoded a private key with XOR.[3] SPAWNCHIMERA has also encrypted data to be extracted using AES encryption.[5][6] |
| Enterprise | T1055.002 | Portable Executable InjectionSub-technique | SPAWNCHIMERA has executed only in memory and hooked itself into existing processes on the victim device to include the web process.[1][2][3] |
| Enterprise | T1559 | Inter-Process Communication | SPAWNCHIMERA has leveraged IPC using a UNIX domain socket between the dsmdm process and the web process.[2][3] |
| Enterprise | T1040 | Network Sniffing | SPAWNCHIMERA has monitored and filtered network traffic on compromised edge devices, allowing legitimate traffic to pass while redirecting attacker-controlled traffic to infrastructure under adversary control. [4][2] |
| Enterprise | T1690 | Prevent Command History Logging | SPAWNCHIMERA has disabled logging and log forwarding on Ivanti devices targeting the `dslogserver` process.[1][5][2][6] |
| Enterprise | T1571 | Non-Standard Port | SPAWNCHIMERA has the ability to bind on a localhost and listen on port 8300.[2][3] |
| Enterprise | T1070.004 | File DeletionSub-technique | SPAWNCHIMERA has deleted generated files and folders from victim devices.[1] |
| Enterprise | T1685 | Disable or Modify Tools | SPAWNCHIMERA has modified the Ivanti Integrity Checker Tool to evade detection.[1][6] |
| Enterprise | T1553.002 | Code SigningSub-technique | SPAWNCHIMERA has generated RSA keys against modified files to sign the manifest file, so they appear legitimate.[1][4] |
| Enterprise | T1070.006 | TimestompSub-technique | SPAWNCHIMERA has updated the timestamp using the `touch` command.[1] |
| Enterprise | T1082 | System Information Discovery | SPAWNCHIMERA has obtained system information such as release, uptime, and current time.[2] |
| Enterprise | T1480.002 | Mutual ExclusionSub-technique | SPAWNCHIMERA has fixed a buffer overflow vulnerability (CVE-2025-0282) by hooking the strncpy function and limiting the size to 256 to prevent other actors from leveraging the exploit.[3] SPAWNCHIMERA has converted its process name to hexadecimal and verifies an added value which is triggered when the first byte of the source copied to the fixed strncpy function matches `0x04050203`.[3] |
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(3)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 20.0 | 1.0 | Current bundle | fef3481c71c3… | ||
| 19.2 | 1.0 | Older bundle | fef3481c71c3… | ||
| 19.1 | 1.0 | Older bundle | fef3481c71c3… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]CISA SPAWNCHIMERA RESURGE February 2026
DHS/CISA. (2026, February 26). MAR-25993211-r1.v2 Ivanti Connect Secure (RESURGE): AR25-087A. Retrieved April 17, 2026.
Open source URL - [2]Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024
Matt Lin, Austin Larsen, John Wolfram, Ashley Pearson, Josh Murchie, Lukasz Lamparski, Joseph Pisano, Ryan Hall, Ron Craft, Shawn Crew, Billy Wong, Tyler McLellan. (2024, April 4). Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies. Retrieved April 16, 2026.
Open source URL - [3]JPCERT SPAWNCHIMERA Ivanti February 2025
Yuma Masubuchi. (2025, February 20). SPAWNCHIMERA Malware: The Chimera Spawning from Ivanti Connect Secure Vulnerability. Retrieved April 17, 2026.
Open source URL - [4]Google UNC5221 Ivanti January 2025
John Wolfram, Josh Murchie, Matt Lin, Daniel Ainsworth, Robert Wallace, Dimiter Andonov, Dhanesh Kizhakkinan, Jacob Thompson. (2025, January 8). Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation. Retrieved April 14, 2026.
Open source URL - [5]Google UNC5221 Ivanti April 2025
John Wolfram, Michael Edie, Jacob Thompson, Matt Lin, Josh Murchie. (2025, April 3). Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457). Retrieved April 13, 2026.
Open source URL - [6]Picus Security UNC5221 Ivanti May 2025
Sila Ozeren Hacioglu. (2025, May 5). UNC5221’s Latest Exploit: Weaponizing CVE-2025-22457 in Ivanti Connect Secure. Retrieved April 13, 2026.
Open source URL - [7]mitre-attackS9024Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.