> We’re honored to be invited to deliver the speech, "Cybersecurity Dynamics in Asia: Case Studies of Ivanti Exploitation and Cross-Border Cyber Operations", at the ST Engineering CYBERSECURITY SUMMIT 2025.


China has been devoted their national resources to develop talents, capabilities and techniques in offensive cyber operations. Their successes are now recognized by so many CTI reports talking about their infiltration into entities around the whole world.

In this talk, we are going to use two case studies, including a global Ivanti exploitation activity in March 2025 and China's cyber espionage activities during the UA-RU conflict, to discuss China's motivation, achievement in cyber space.

See you there!

## Info
- **Date**: July 4, 2025
- **Time**: 14:30 - 16:00 (Breakout Track 2 - Cyber Threat Intelligence)
- **Venue**: 
Sands Expo & Convention Centre 
Roselle Simpor Ballroom, Level 4 
(10 Bayfront Ave, Singapore 018956) 
- **More info**: https://stenggcybersecuritysummit.sg/

【Speech】 TeamT5 will be at ST Engineering CYBERSECURITY SUMMIT 2025 (Singapore)

> TeamT5 杜浦數位安全很榮幸受邀於 ST Engineering CYBERSECURITY SUMMIT 2025 發表演講。
 
本次演講主題為「Cybersecurity Dynamics in Asia: Case Studies of Ivanti Exploitation and Cross-Border Cyber Operations」。我們觀察到中國投入國家資源，致力於培養攻擊性網路行動的人才、能力和技術。如今，許多威脅情資報告都指出中國達成其目標，並探討了中國對全球組織的滲透。

而本次演講將透過兩個案例研究，包括 2025 年 3 月的全球 Ivanti 漏洞活動和中國在美國-俄羅斯衝突期間的網路間諜活動，探討中國在網路空間的動機和事件。

期待與您現場相見，交流資安態勢看法。

## 演講資訊
- **日期**: 2025年7月4日
- **時間**: 14:30 - 16:00 (Breakout Track 2 - Cyber Threat Intelligence)
- **地點**: 
Sands Expo & Convention Centre 
Roselle Simpor Ballroom, Level 4 
(10 Bayfront Ave, Singapore 018956) 
 
- **官網**: https://stenggcybersecuritysummit.sg/

【演講資訊】TeamT5 即將參與 ST Engineering CYBERSECURITY SUMMIT 2025 (新加坡)

In late March, TeamT5 detected that the China-nexus APT group exploited the critical vulnerability in Ivanti Connect Secure VPN appliances to infiltrate multiple entities around the globe. The victims include nearly twenty different industries across twelve countries. We believe that the actor still maintained control over the victim's network at the time of analysis.

## Victimology
**The victim countries** include Austria, Australia, France, Spain, Japan, South Korea, Netherlands, Singapore, Taiwan, the United Arab Emirates, the United Kingdom, and the United States. **The targeted industries** include Automotive, Chemical, Conglomerate, Construction, Information Security, Education, Electronics, Financial Institution, Gambling, Government, Intergovernmental Organizations (IGO), Information Technology, Law Firm, Manufacturing, Materials, Media, Non-Governmental Organizations (NGOs), Research Institute, Telecommunication.

## Threat Details
Our analysis assessed with high confidence that the actor was exploiting the vulnerabilities of Ivanti Connect Secure VPN appliances to launch attacks around the globe. The actor possibly exploited CVE-2025-0282[1] or CVE-2025-22457[2] to conduct initial access.

Both CVE-2025-0282 and CVE-2025-22457 are stack buffer overflow vulnerabilities in Ivanti Connect Secure VPN with a CVSS score of `9.0`. Successful exploitation allows the threat actor to achieve remote code execution, leading to intrusion of the internal network and malware implantation.

In the attack, the actor deployed a shared weapon among Chinese threat groups, SPAWNCHIMERA. SPAWNCHIMERA is developed specifically for Ivanti Connect Secure VPN and has all the functionalities of the notorious SPAWN family, including SPAWNANT (installer), SPAWNMOLE (socks5 tunnler), SPAWNSNAIL (SSH backdoor), and SPAWNSLOTH (log wiper).

Moreover, our analysis suggests that other threat actors might also obtain the vulnerability information and start campaigns targeting Ivanti VPN appliances. We have observed massive exploitation attempts against Ivanti VPN appliances since April. Although most exploitation attempts failed, many Ivanti VPN appliances became paralyzed and unstable. 

TeamT5 strongly recommends that affected organizations conduct a thorough incident investigation. Given the versatile TTPs of the actor, such as multi-layers of C2 infrastructure, evasion of monitor mechanism, and the usage of log wiper, without additional technical support, it would be a challenge to detect the actor’s malicious traces inside the network. 

Contact us for assistance - [https://teamt5.org/en/contact-us/](https://teamt5.org/en/contact-us/?utm_source=blog&utm_medium=website).

 
 

[1]
[CVE-2025-0282](https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283?language=en_US)

[2] 
[CVE-2025-22457](https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457?language=en_US)

China-nexus APT exploits Ivanti Connect Secure VPN vulnerability to infiltrate multiple entities

3 月底，TeamT5 的遙測察知中國相關 APT 族群利用 Ivanti Connect Secure VPN 高風險漏洞發動攻擊，受害單位橫跨全世界 12 個國家，近 20 個不同產業。截至分析時，我們確信攻擊者仍持續控制受害者的網路。

## 受害單位
**受害國家**奧地利、澳洲、法國、西班牙、日本、南韓、荷蘭、新加坡、台灣、英國、美國、阿拉伯聯合大公國。而**受害產業**則包括汽車、化學、電信、營造、資安、教育、電子、金融、博弈、政府、法律、製造、媒體、企業集團、跨政府組織、非政府組織、資訊科技、研究機構。

## 威脅細節
我們的分析持高度信心攻擊者是利用 Ivanti Connect Secure VPN 相關的高風險漏洞展開攻擊。根據我們目前掌握的資訊，攻擊者可能是利用 CVE-2025-0282[1] 或 CVE-2025-22457[2] 取得初步存取權限。

CVE-2025-0282 和 CVE-2025-22457 都是 Ivanti Connect Secure VPN 的堆疊緩衝區溢位（stack buffer overflow）漏洞，CVSS 分數為 `9.0`。漏洞成功利用後，威脅行動者便得以實現遠端程式碼執行，進而入侵內部網路和部署惡意程式。

在這起攻擊中，攻擊者部署的是中國威脅族群的共用惡意程式 SPAWNCHIMERA。SPAWNCHIMERA 是專為 Ivanti Connect Secure VPN 所開發，具備 SPAWN 家族惡意程式的所有功能，包括 SPAWNANT （安裝程式）、SPAWNMOLE（socks5 網路隧道程式）、SPAWNSNAIL（SSH 後門程式）和 SPAWNSLOTH（記錄抹除程式）。

此外，我們的分析研判，其他威脅行動者可能也有取得漏洞相關資訊，並著手展開針對 Ivanti VPN 設備的攻擊行動。自 4 月以來，我們發現針對 Ivanti VPN 設備的大規模漏洞攻擊嘗試。雖然絕大多數的漏洞攻擊嘗試都以失敗告終，但卻也造成這些 Ivanti VPN 設備被癱瘓且變得不穩定。

TeamT5 建議受影響單位應即刻展開完整的事件調查。基於攻擊者手法的多變性，如多層次 C2 基礎架構、監控機制迴避與使用記錄抹除程式，若缺乏額外的技術協助，恐不易深入調查內部網路的攻擊者足跡。若需任何進一步的技術協助，可[直接聯繫 TeamT5](https://teamt5.org/tw/contact-us/?utm_source=blog&utm_medium=website)。

 
 

[1]
[CVE-2025-0282](https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283?language=en_US)

[2] 
[CVE-2025-22457](https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457?language=en_US)

中國相關威脅行動者利用 Ivanti Connect Secure VPN 漏洞滲透多國單位

Threat Intelligence

>TeamT5 杜浦數位安全為專精亞太地區威脅情資的領導品牌。於此篇文章中，我們總結 2024 年亞太地區進階持續性威脅（APT）的威脅態勢，不僅提出年度觀察，更指出未來一年值得留意的資安威脅。

>本篇文章為節錄版，摘述關鍵數據與威脅情資分析。**欲取得完整《2024年威脅態勢回顧: 網路攻擊的模糊地帶》報告，您可以直接填寫文章末尾表格，我們將透過電子郵件、寄送給您。**

>欲探索更多亞太地區的威脅情資，立刻申請獲得國際顧問公司肯定的威脅情資平台 ThreatVision 試用機會。請在 [ThreatVision 頁面](https://teamt5.org/tw/products/threatvision/?utm_source=blog&utm_medium=website) 說明您希望申請試用。

##Threat Statistics in 2024: Data & Observations

In 2024, until the end of November, TeamT5 actively tracked 30 new vulnerabilities being exploited in the wild, along with around 500 attack operations across 42 countries, which we attributed to 73 known adversaries and more than 200 malware / hacking tools being used. 

We also identified 45 victims being compromised in 9 countries and tried to notify through our trustworthy partners. And helped 33 IR cases for our customers. You could imagine all the above data contributing to our intelligence reports. Generally speaking, most of them show a tendency of increasing.

TeamT5 is actively tracking vulnerability exploitation attacks in the wild. In 2024, 30 widespread attacks were tracked by TeamT5, around 400 victim hosts across 21 countries were identified to be compromised.

We would like to highlight that 5 of them are email system related and 14 are exploiting edge devices, indicating they are high priorities of threat actors to access targets. Our research also shows EtherBei (aka Flax Typhoon) to be the most active threat actors to adopt these exploits.

During the course of our research, we also discovered some threat actors built their botnet or so called Operation Relay Box network by implanting malware like GobRAT, NatWalk and GenSeven.

Lastly, there’s also a tendency that more management services of edge devices are being exploited, such as FortiManager, Versa Director or Palo Alto Firewall, e.t.c., meaning that threat actors might compromise multiple entities by intruding on one device. We believe this is a threat that management service providers or big enterprises should be aware of.

![](https://uploads.teamt5.org/upload/original/pic1_apt-threat-landscape-in-apac-2024.png)

 

>本篇文章為節錄版，摘述關鍵數據與威脅情資分析。欲取得完整《2024年威脅態勢回顧: 網路攻擊的模糊地帶》報告，您可以直接填寫文章末尾表格，我們將透過電子郵件、寄送給您。

>欲探索更多亞太地區的威脅情資，立刻申請獲得國際顧問公司肯定的威脅情資平台 ThreatVision 試用機會。請在 [ThreatVision 頁面](https://teamt5.org/tw/products/threatvision/?utm_source=blog&utm_medium=website) 說明您希望申請試用。

2024年威脅態勢回顧: 網路攻擊的模糊地帶【英文威脅情資報告】

>TeamT5 is a leading brand in delivering Asia Pacific intelligence. In this article, we summarize the threat landscape of advanced persistent threats (APT) in the Asia-Pacific region in 2024, not only provide annual observations, but also point out the cyber threats worth paying attention to in 2024.

>This article is an excerpt version which summarizes key statistics. **To obtain the complete threat intelligence report, you may fill up the form at the bottom to obtain the “APT Threat Landscape in APAC 2024: Blurred Lines of Cyber Attacks” report.**

>To discover similar cyber threat intelligence which is focused in the Asia-Pacific region, please sign up for the trial of our award-winning threat intelligence platform ThreatVision. Please indicate on the [ThreatVision page](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website) that you would like to apply for trial.

##Threat Statistics in 2024: Data & Observations

In 2024, until the end of November, TeamT5 actively tracked 30 new vulnerabilities being exploited in the wild, along with around 500 attack operations across 42 countries, which we attributed to 73 known adversaries and more than 200 malware / hacking tools being used. 

We also identified 45 victims being compromised in 9 countries and tried to notify through our trustworthy partners. And helped 33 IR cases for our customers. You could imagine all the above data contributing to our intelligence reports. Generally speaking, most of them show a tendency of increasing.

TeamT5 is actively tracking vulnerability exploitation attacks in the wild. In 2024, 30 widespread attacks were tracked by TeamT5, around 400 victim hosts across 21 countries were identified to be compromised.

We would like to highlight that 5 of them are email system related and 14 are exploiting edge devices, indicating they are high priorities of threat actors to access targets. Our research also shows EtherBei (aka Flax Typhoon) to be the most active threat actors to adopt these exploits.

During the course of our research, we also discovered some threat actors built their botnet or so called Operation Relay Box network by implanting malware like GobRAT, NatWalk and GenSeven.

Lastly, there’s also a tendency that more management services of edge devices are being exploited, such as FortiManager, Versa Director or Palo Alto Firewall, e.t.c., meaning that threat actors might compromise multiple entities by intruding on one device. We believe this is a threat that management service providers or big enterprises should be aware of.

![](https://uploads.teamt5.org/upload/original/pic1_apt-threat-landscape-in-apac-2024.png)

>This article is an excerpt version which summarizes key statistics. To obtain the complete threat intelligence report, you may fill up the form at the bottom to obtain the “APT Threat Landscape in APAC 2024: Blurred Lines of Cyber Attacks” report.

>To discover similar cyber threat intelligence which is focused in the Asia-Pacific region, please sign up for the trial of our award-winning threat intelligence platform ThreatVision. Please indicate on the [ThreatVision page](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website) that you would like to apply for trial.


APT Threat Landscape in APAC 2024: Blurred Lines of Cyber Attacks

>TeamT5は、アジア太平洋地域(APAC)における脅威インテリジェンスを専門とするセキュリティベンダーです。 本記事では、2024年のAPACにおけるAPT（Advanced Persistent Threats：高度標的型攻撃）の脅威状況をまとめ、毎年恒例のレビューだけでなく、今後1年間注意すべきセキュリティ脅威についてもご紹介します。

>本記事は、主要データと脅威インテリジェンス分析を要約したものです。 **「2024年脅威ランドスケープのレビュー：曖昧になるサイバー攻撃の境界線」全文の閲覧をご希望の方は、下部のフォームにご記入ください**。

>アジア太平洋地域の脅威インテリジェンスについてさらに詳しく知りたい方は、国際的なコンサルタントから受賞歴のある脅威インテリジェンスプラットフォームThreatVisionのトライアルを申し込むことが出来ます。[ThreatVision](https://teamt5.org/jp/products/threatvision/?utm_source=blog&utm_medium=website)のページよりトライアルを希望する旨をご記入ください。

##Threat Statistics in 2024: Data & Observations

In 2024, until the end of November, TeamT5 actively tracked 30 new vulnerabilities being exploited in the wild, along with around 500 attack operations across 42 countries, which we attributed to 73 known adversaries and more than 200 malware / hacking tools being used. 

We also identified 45 victims being compromised in 9 countries and tried to notify through our trustworthy partners. And helped 33 IR cases for our customers. You could imagine all the above data contributing to our intelligence reports. Generally speaking, most of them show a tendency of increasing.

TeamT5 is actively tracking vulnerability exploitation attacks in the wild. In 2024, 30 widespread attacks were tracked by TeamT5, around 400 victim hosts across 21 countries were identified to be compromised.

We would like to highlight that 5 of them are email system related and 14 are exploiting edge devices, indicating they are high priorities of threat actors to access targets. Our research also shows EtherBei (aka Flax Typhoon) to be the most active threat actors to adopt these exploits.

During the course of our research, we also discovered some threat actors built their botnet or so called Operation Relay Box network by implanting malware like GobRAT, NatWalk and GenSeven.

Lastly, there’s also a tendency that more management services of edge devices are being exploited, such as FortiManager, Versa Director or Palo Alto Firewall, e.t.c., meaning that threat actors might compromise multiple entities by intruding on one device. We believe this is a threat that management service providers or big enterprises should be aware of.

![](https://uploads.teamt5.org/upload/original/pic1_apt-threat-landscape-in-apac-2024.png)

>本記事は、主要データと脅威インテリジェンス分析を要約したものです。 「2024年脅威ランドスケープのレビュー：曖昧になるサイバー攻撃の境界線」全文の閲覧をご希望の方は、下部のフォームにご記入ください。

>アジア太平洋地域の脅威インテリジェンスについてさらに詳しく知りたい方は、国際的なコンサルタントから受賞歴のある脅威インテリジェンスプラットフォームThreatVisionのトライアルを申し込むことが出来ます。[ThreatVision](https://teamt5.org/jp/products/threatvision/?utm_source=blog&utm_medium=website)のページよりトライアルを希望する旨をご記入ください。


【Speech】 TeamT5 will be at ST Engineering CYBERSECURITY SUMMIT 2025 (Singapore)

Info

Related Post

China-nexus APT exploits Ivanti Connect Secure VPN vulnerability to infiltrate multiple entities

APT Threat Landscape in APAC 2024: Blurred Lines of Cyber Attacks