InfoSecBulletin Cybersecurity for mankind
In late March, TeamT5 found that a China-linked APT group exploited a critical vulnerability in Ivanti Connect Secure VPN appliances, affecting nearly twenty industries in twelve countries. At the time of the analysis, TeamT5 suspected that the group still had access to the victims’ networks.
Victim countries include Austria, Australia, France, Spain, Japan, South Korea, the Netherlands, Singapore, Taiwan, the United Arab Emirates, the United Kingdom, and the United States. Targeted industries encompass Automotive, Chemical, Conglomerate, Construction, Information Security, Education, Electronics, Financial Institutions, Gambling, Government, IGOs, Information Technology, Law Firms, Manufacturing, Materials, Media, NGOs, Research Institutes, and Telecommunications.
Bengaluru firm got ransomware attack, Hacker demanded $70,000
MITRE warns: U.S. Govt. Funding for MITRE’s CVE Ends Today
PwC exits more than a dozen countries in push to avoid scandals: FT reports
Australian Cyber Security Centre Alert for Fortinet Products
Top 10 Malware Threats of the Week: Reports ANY.RUN
Hackers Exploit Ivanti VPN Vulns 12 Countries to Infiltrate Multiple Orgs
Hackers Allegedly Advertise To Sell FortiGate Firewall 0-Day Exploit
New Security Companies Who Are Exploring the Bangladeshi Market
Hackers retain access to patched FortiGate VPNs using symlinks
CISA Releases Ten Industrial Control Systems Advisories
Threat Details:
TeamT5 assessed that an actor exploited vulnerabilities in Ivanti Connect Secure VPN appliances to launch global attacks, possibly using CVE-2025-0282 or CVE-2025-22457 for initial access.
CVE-2025-0282 and CVE-2025-22457 are stack buffer overflow vulnerabilities in Ivanti Connect Secure VPN, both with a CVSS score of 9.0. Exploiting these vulnerabilities can enable remote code execution, compromising the internal network and allowing malware installation.
The attacker used a shared weapon called SPAWNCHIMERA, developed for Ivanti Connect Secure VPN. This tool includes features from the infamous SPAWN family, such as SPAWNANT (installer), SPAWNMOLE (socks5 tunneler), SPAWNSNAIL (SSH backdoor), and SPAWNSLOTH (log wiper).
TEAMT5 analysis indicates that other threat actors could exploit vulnerability information and launch campaigns against Ivanti VPN appliances. Since April, there have been significant attempts to exploit these appliances, leading to many of them becoming paralyzed and unstable, despite most attempts failing.
TeamT5 advises affected organizations to conduct a detailed incident investigation. Due to the actor’s flexible tactics, including complex command and control (C2) setups, evading detection, and using a log wiper, detecting their malicious activity within the network will be difficult without further technical assistance.
Cybersecuritynews reported the APT group, assessed by Mandiant as UNC5221 with ties to Chinese state interests, weaponized the Ivanti vulnerabilities to achieve unauthenticated remote code execution (RCE).
Mandiant warns that the SPAWNCHIMERA toolkit’s sophistication, including UNIX socket communication and obfuscated payloads—reflects Beijing’s growing focus on cyber espionage against geopolitical rivals.
Security analysts at Rapid7 confirmed the vulnerabilities’ exploitability, noting that CVE-2025-22457 initially appeared as a low-risk denial-of-service bug but was later weaponized for RCE.
New Security Companies Who Are Exploring the Bangladeshi Market
