InfoSecBulletin Cybersecurity for mankind
In late March, TeamT5 found that a China-linked APT group exploited a critical vulnerability in Ivanti Connect Secure VPN appliances, affecting nearly twenty industries in twelve countries. At the time of the analysis, TeamT5 suspected that the group still had access to the victims’ networks.
Victim countries include Austria, Australia, France, Spain, Japan, South Korea, the Netherlands, Singapore, Taiwan, the United Arab Emirates, the United Kingdom, and the United States. Targeted industries encompass Automotive, Chemical, Conglomerate, Construction, Information Security, Education, Electronics, Financial Institutions, Gambling, Government, IGOs, Information Technology, Law Firms, Manufacturing, Materials, Media, NGOs, Research Institutes, and Telecommunications.
Russia detects first SuperCard malware attacks via NFC
Income Property Investments exposes 170,000+ Individuals record
ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs
CISA Flags Active Exploits in Apple iOS and TP-Link Routers
10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online
Canada 2nd largest airlines “WestJet” investigates cyberattack disrupting internal systems
Paraguay 7.4 Million Citizen Records Leaked on Dark Web
High-Severity Flaw in HashiCorp Nomad Allows Privilege Escalation
SoftBank: Over 137,000 personal info leaked
Alert
Trend Micro Apex One Flaw Allow Attackers to Inject Malicious Code
Threat Details:
TeamT5 assessed that an actor exploited vulnerabilities in Ivanti Connect Secure VPN appliances to launch global attacks, possibly using CVE-2025-0282 or CVE-2025-22457 for initial access.
CVE-2025-0282 and CVE-2025-22457 are stack buffer overflow vulnerabilities in Ivanti Connect Secure VPN, both with a CVSS score of 9.0. Exploiting these vulnerabilities can enable remote code execution, compromising the internal network and allowing malware installation.
The attacker used a shared weapon called SPAWNCHIMERA, developed for Ivanti Connect Secure VPN. This tool includes features from the infamous SPAWN family, such as SPAWNANT (installer), SPAWNMOLE (socks5 tunneler), SPAWNSNAIL (SSH backdoor), and SPAWNSLOTH (log wiper).
TEAMT5 analysis indicates that other threat actors could exploit vulnerability information and launch campaigns against Ivanti VPN appliances. Since April, there have been significant attempts to exploit these appliances, leading to many of them becoming paralyzed and unstable, despite most attempts failing.
TeamT5 advises affected organizations to conduct a detailed incident investigation. Due to the actor’s flexible tactics, including complex command and control (C2) setups, evading detection, and using a log wiper, detecting their malicious activity within the network will be difficult without further technical assistance.
Cybersecuritynews reported the APT group, assessed by Mandiant as UNC5221 with ties to Chinese state interests, weaponized the Ivanti vulnerabilities to achieve unauthenticated remote code execution (RCE).
Mandiant warns that the SPAWNCHIMERA toolkit’s sophistication, including UNIX socket communication and obfuscated payloads—reflects Beijing’s growing focus on cyber espionage against geopolitical rivals.
Security analysts at Rapid7 confirmed the vulnerabilities’ exploitability, noting that CVE-2025-22457 initially appeared as a low-risk denial-of-service bug but was later weaponized for RCE.
New Security Companies Who Are Exploring the Bangladeshi Market
