InfoSecBulletin Cybersecurity for mankind
In late March, TeamT5 found that a China-linked APT group exploited a critical vulnerability in Ivanti Connect Secure VPN appliances, affecting nearly twenty industries in twelve countries. At the time of the analysis, TeamT5 suspected that the group still had access to the victims’ networks.
Victim countries include Austria, Australia, France, Spain, Japan, South Korea, the Netherlands, Singapore, Taiwan, the United Arab Emirates, the United Kingdom, and the United States. Targeted industries encompass Automotive, Chemical, Conglomerate, Construction, Information Security, Education, Electronics, Financial Institutions, Gambling, Government, IGOs, Information Technology, Law Firms, Manufacturing, Materials, Media, NGOs, Research Institutes, and Telecommunications.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
Threat Details:
TeamT5 assessed that an actor exploited vulnerabilities in Ivanti Connect Secure VPN appliances to launch global attacks, possibly using CVE-2025-0282 or CVE-2025-22457 for initial access.
CVE-2025-0282 and CVE-2025-22457 are stack buffer overflow vulnerabilities in Ivanti Connect Secure VPN, both with a CVSS score of 9.0. Exploiting these vulnerabilities can enable remote code execution, compromising the internal network and allowing malware installation.
The attacker used a shared weapon called SPAWNCHIMERA, developed for Ivanti Connect Secure VPN. This tool includes features from the infamous SPAWN family, such as SPAWNANT (installer), SPAWNMOLE (socks5 tunneler), SPAWNSNAIL (SSH backdoor), and SPAWNSLOTH (log wiper).
TEAMT5 analysis indicates that other threat actors could exploit vulnerability information and launch campaigns against Ivanti VPN appliances. Since April, there have been significant attempts to exploit these appliances, leading to many of them becoming paralyzed and unstable, despite most attempts failing.
TeamT5 advises affected organizations to conduct a detailed incident investigation. Due to the actor’s flexible tactics, including complex command and control (C2) setups, evading detection, and using a log wiper, detecting their malicious activity within the network will be difficult without further technical assistance.
Cybersecuritynews reported the APT group, assessed by Mandiant as UNC5221 with ties to Chinese state interests, weaponized the Ivanti vulnerabilities to achieve unauthenticated remote code execution (RCE).
Mandiant warns that the SPAWNCHIMERA toolkit’s sophistication, including UNIX socket communication and obfuscated payloads—reflects Beijing’s growing focus on cyber espionage against geopolitical rivals.
Security analysts at Rapid7 confirmed the vulnerabilities’ exploitability, noting that CVE-2025-22457 initially appeared as a low-risk denial-of-service bug but was later weaponized for RCE.
New Security Companies Who Are Exploring the Bangladeshi MarketÂ
