SPAWNCHIMERA
Software · ATTACK:enterprise:S9024
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S9024",
"title": "SPAWNCHIMERA",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S9024",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--d1974f35-0e06-478e-bc74-7530545d814b",
"external_id": "S9024",
"domain": "enterprise",
"created": "2026-04-17T18:25:01.807Z",
"modified": "2026-04-23T02:42:16.476Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "CISA SPAWNCHIMERA RESURGE February 2026",
"url": "https://www.cisa.gov/news-events/analysis-reports/ar25-087a"
},
{
"source_name": "Google UNC5221 Ivanti January 2025",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day"
},
{
"source_name": "Google UNC5221 Ivanti April 2025",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-exploiting-critical-ivanti-vulnerability"
},
{
"source_name": "Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement"
},
{
"source_name": "Picus Security UNC5221 Ivanti May 2025",
"url": "https://www.picussecurity.com/resource/blog/unc5221-cve-2025-22457-ivanti-connect-secure"
},
{
"source_name": "JPCERT SPAWNCHIMERA Ivanti February 2025",
"url": "https://blogs.jpcert.or.jp/en/2025/02/spawnchimera.html"
}
]
}Explicit source assertions (23)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--01fa087f-2238-4bd6-b2d9-8fca29ac9cb0
JPCERT SPAWNCHIMERA Ivanti February 2025ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--029f4f57-f14b-47c3-9c34-afe3c2e465ae
CISA SPAWNCHIMERA RESURGE February 2026 · Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21f43802-8abd-459f-83e3-d9fd3fdd5bfa
CISA SPAWNCHIMERA RESURGE February 2026ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1505.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2a795c6b-e582-473c-ae2d-3e6e8e7c8c72
CISA SPAWNCHIMERA RESURGE February 2026ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1574
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3270c057-e0ee-4a0c-a503-cad4782b6dc2
Google UNC5221 Ivanti January 2025 · Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1037
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--337c9a57-3dbb-4ffd-9393-ade1b8ff89a6
CISA SPAWNCHIMERA RESURGE February 2026ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--37d43abb-78c6-45b7-927d-353f5f95c322
Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--43828aaa-5c0c-41e1-ae38-6e2abd43120d
CISA SPAWNCHIMERA RESURGE February 2026 · Google UNC5221 Ivanti April 2025 · Picus Security UNC5221 Ivanti May 2025ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c637450-dd7b-4f6a-b59d-628d8258e0cd
CISA SPAWNCHIMERA RESURGE February 2026 · Google UNC5221 Ivanti January 2025 · Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1059.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--60e86d7e-a3b9-4929-9933-84aba4a45ff3
CISA SPAWNCHIMERA RESURGE February 2026ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1574.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7beb0954-f5b9-4c41-a732-c4ebb961148a
Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8cde73bb-6287-4765-9b45-d8bfd6dfde4d
Google UNC5221 Ivanti April 2025 · Picus Security UNC5221 Ivanti May 2025 · JPCERT SPAWNCHIMERA Ivanti February 2025ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1055.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a5fe256f-67fa-4085-bb44-e05b399e66ca
CISA SPAWNCHIMERA RESURGE February 2026 · Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024 · JPCERT SPAWNCHIMERA Ivanti February 2025ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1559
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a65e797a-d529-427b-82aa-33edf4ead0a2
Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024 · JPCERT SPAWNCHIMERA Ivanti February 2025ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1040
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aa03a8fe-d67f-43b8-8108-c877734044e5
Google UNC5221 Ivanti January 2025 · Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1690
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ba2f665e-0241-463b-a49a-076d8f5bb5a1
CISA SPAWNCHIMERA RESURGE February 2026 · Google UNC5221 Ivanti April 2025 · Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024 · Picus Security UNC5221 Ivanti May 2025ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1571
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c0a3674d-ff9b-49e0-8a18-43ba8d795163
Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024 · JPCERT SPAWNCHIMERA Ivanti February 2025ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec2949a1-7ffa-49c4-9a24-c53638f4980a
CISA SPAWNCHIMERA RESURGE February 2026ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f03fd4ac-f8c5-4904-a973-62b863a418f9
CISA SPAWNCHIMERA RESURGE February 2026 · Picus Security UNC5221 Ivanti May 2025ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f1964de7-05d2-46e9-a04e-c2d739976306
CISA SPAWNCHIMERA RESURGE February 2026 · Google UNC5221 Ivanti January 2025ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f1e4c1ce-98d7-43fd-af33-f26f73aeca8b
CISA SPAWNCHIMERA RESURGE February 2026ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fbcc97eb-3768-4c8f-b00e-eb84a69fc0da
Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fd429e36-81b7-4e3d-a537-e27c0c6258d1
JPCERT SPAWNCHIMERA Ivanti February 2025