InfoSecBulletin Cybersecurity for mankind
In late March, TeamT5 found that a China-linked APT group exploited a critical vulnerability in Ivanti Connect Secure VPN appliances, affecting nearly twenty industries in twelve countries. At the time of the analysis, TeamT5 suspected that the group still had access to the victims’ networks.
Victim countries include Austria, Australia, France, Spain, Japan, South Korea, the Netherlands, Singapore, Taiwan, the United Arab Emirates, the United Kingdom, and the United States. Targeted industries encompass Automotive, Chemical, Conglomerate, Construction, Information Security, Education, Electronics, Financial Institutions, Gambling, Government, IGOs, Information Technology, Law Firms, Manufacturing, Materials, Media, NGOs, Research Institutes, and Telecommunications.
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
500+ critical infrastructure hit by Medusa ransomware
Critical WordPress Plugin Flaw Exposes 600,000 Sites to Attacks
Threat Details:
TeamT5 assessed that an actor exploited vulnerabilities in Ivanti Connect Secure VPN appliances to launch global attacks, possibly using CVE-2025-0282 or CVE-2025-22457 for initial access.
CVE-2025-0282 and CVE-2025-22457 are stack buffer overflow vulnerabilities in Ivanti Connect Secure VPN, both with a CVSS score of 9.0. Exploiting these vulnerabilities can enable remote code execution, compromising the internal network and allowing malware installation.
The attacker used a shared weapon called SPAWNCHIMERA, developed for Ivanti Connect Secure VPN. This tool includes features from the infamous SPAWN family, such as SPAWNANT (installer), SPAWNMOLE (socks5 tunneler), SPAWNSNAIL (SSH backdoor), and SPAWNSLOTH (log wiper).
TEAMT5 analysis indicates that other threat actors could exploit vulnerability information and launch campaigns against Ivanti VPN appliances. Since April, there have been significant attempts to exploit these appliances, leading to many of them becoming paralyzed and unstable, despite most attempts failing.
TeamT5 advises affected organizations to conduct a detailed incident investigation. Due to the actor’s flexible tactics, including complex command and control (C2) setups, evading detection, and using a log wiper, detecting their malicious activity within the network will be difficult without further technical assistance.
Cybersecuritynews reported the APT group, assessed by Mandiant as UNC5221 with ties to Chinese state interests, weaponized the Ivanti vulnerabilities to achieve unauthenticated remote code execution (RCE).
Mandiant warns that the SPAWNCHIMERA toolkit’s sophistication, including UNIX socket communication and obfuscated payloads—reflects Beijing’s growing focus on cyber espionage against geopolitical rivals.
Security analysts at Rapid7 confirmed the vulnerabilities’ exploitability, noting that CVE-2025-22457 initially appeared as a low-risk denial-of-service bug but was later weaponized for RCE.
New Security Companies Who Are Exploring the Bangladeshi Market
