InfoSecBulletin Cybersecurity for mankind
In late March, TeamT5 found that a China-linked APT group exploited a critical vulnerability in Ivanti Connect Secure VPN appliances, affecting nearly twenty industries in twelve countries. At the time of the analysis, TeamT5 suspected that the group still had access to the victims’ networks.
Victim countries include Austria, Australia, France, Spain, Japan, South Korea, the Netherlands, Singapore, Taiwan, the United Arab Emirates, the United Kingdom, and the United States. Targeted industries encompass Automotive, Chemical, Conglomerate, Construction, Information Security, Education, Electronics, Financial Institutions, Gambling, Government, IGOs, Information Technology, Law Firms, Manufacturing, Materials, Media, NGOs, Research Institutes, and Telecommunications.
Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora
Australia enacts mandatory ransomware payment reporting
Why Govt Demands Foreign CCTV Firms to Submit Source Code?
CVE-2023-39780
Botnet hacks thousands of ASUS routers
Bangladesh Bank instructed using AI to prevent online gambling
251 Amazon-Hosted IPs Used in Exploit Scan for ColdFusion, Struts, and Elasticsearch
Zero-Trust Policy bypass to Exploit Vulns & Manipulate NHI Secrets
Evaly E-commerce Platform Allegedly Hacked
Exploitable Vulns in Canon Printers Allow Gaining Admin Privileges
184 Million Leaked Credentials Discovered in Open Database
Threat Details:
TeamT5 assessed that an actor exploited vulnerabilities in Ivanti Connect Secure VPN appliances to launch global attacks, possibly using CVE-2025-0282 or CVE-2025-22457 for initial access.
CVE-2025-0282 and CVE-2025-22457 are stack buffer overflow vulnerabilities in Ivanti Connect Secure VPN, both with a CVSS score of 9.0. Exploiting these vulnerabilities can enable remote code execution, compromising the internal network and allowing malware installation.
The attacker used a shared weapon called SPAWNCHIMERA, developed for Ivanti Connect Secure VPN. This tool includes features from the infamous SPAWN family, such as SPAWNANT (installer), SPAWNMOLE (socks5 tunneler), SPAWNSNAIL (SSH backdoor), and SPAWNSLOTH (log wiper).
TEAMT5 analysis indicates that other threat actors could exploit vulnerability information and launch campaigns against Ivanti VPN appliances. Since April, there have been significant attempts to exploit these appliances, leading to many of them becoming paralyzed and unstable, despite most attempts failing.
TeamT5 advises affected organizations to conduct a detailed incident investigation. Due to the actor’s flexible tactics, including complex command and control (C2) setups, evading detection, and using a log wiper, detecting their malicious activity within the network will be difficult without further technical assistance.
Cybersecuritynews reported the APT group, assessed by Mandiant as UNC5221 with ties to Chinese state interests, weaponized the Ivanti vulnerabilities to achieve unauthenticated remote code execution (RCE).
Mandiant warns that the SPAWNCHIMERA toolkit’s sophistication, including UNIX socket communication and obfuscated payloads—reflects Beijing’s growing focus on cyber espionage against geopolitical rivals.
Security analysts at Rapid7 confirmed the vulnerabilities’ exploitability, noting that CVE-2025-22457 initially appeared as a low-risk denial-of-service bug but was later weaponized for RCE.
New Security Companies Who Are Exploring the Bangladeshi Market
