>TeamT5 is a leading brand in delivering Asia Pacific intelligence. Our CTI analyst took The New York Times’s interview and made comments. This is an expert of The New York Times's article. Read more at
 [The New York Times](https://www.nytimes.com/2025/06/19/world/europe/china-hackers-russia-war-ukraine.html).

The hacking campaign shows that, despite this partnership and years of promises not to hack each other, China sees Russia as a vulnerable target. In 2023, one group, known as Sanyo, impersonated the email addresses of a major Russian engineering firm in the hunt for information on nuclear submarines, according to TeamT5, a Taiwan-based cybersecurity research firm that discovered the attack last year and linked it to the Chinese government.

……

“China likely seeks to gather intelligence on Russia’s activities, including on its military operation in Ukraine, defense developments and other geopolitical maneuvers,” said Che Chang, a researcher with TeamT5.

……

 
 
(cover source：pexels)

[The New York Times] China Is Hacking Russia to Steal War Secrets

>亞太威脅情資專家 TeamT5 長期關注中國駭客族群與攻擊事件，接受紐約時報 (The New York Times)訪問，進行評論。本文為摘錄，完整文章請見 [The New York Times](https://www.nytimes.com/2025/06/19/world/europe/china-hackers-russia-war-ukraine.html)。

The hacking campaign shows that, despite this partnership and years of promises not to hack each other, China sees Russia as a vulnerable target. In 2023, one group, known as Sanyo, impersonated the email addresses of a major Russian engineering firm in the hunt for information on nuclear submarines, according to TeamT5, a Taiwan-based cybersecurity research firm that discovered the attack last year and linked it to the Chinese government.

……

“China likely seeks to gather intelligence on Russia’s activities, including on its military operation in Ukraine, defense developments and other geopolitical maneuvers,” said Che Chang, a researcher with TeamT5.


 
 
（首圖來源：pexels）

【The New York Times 採訪報導】China Is Hacking Russia to Steal War Secrets

>TeamT5 杜浦數位安全為專精亞太地區威脅情資的領導品牌。於此篇文章中，我們總結 2024 年亞太地區進階持續性威脅（APT）的威脅態勢，不僅提出年度觀察，更指出未來一年值得留意的資安威脅。

>本篇文章為節錄版，摘述關鍵數據與威脅情資分析。**欲取得完整《2024年威脅態勢回顧: 網路攻擊的模糊地帶》報告，您可以直接填寫文章末尾表格，我們將透過電子郵件、寄送給您。**

>欲探索更多亞太地區的威脅情資，立刻申請獲得國際顧問公司肯定的威脅情資平台 ThreatVision 試用機會。請在 [ThreatVision 頁面](https://teamt5.org/tw/products/threatvision/?utm_source=blog&utm_medium=website) 說明您希望申請試用。

##Threat Statistics in 2024: Data & Observations

In 2024, until the end of November, TeamT5 actively tracked 30 new vulnerabilities being exploited in the wild, along with around 500 attack operations across 42 countries, which we attributed to 73 known adversaries and more than 200 malware / hacking tools being used. 

We also identified 45 victims being compromised in 9 countries and tried to notify through our trustworthy partners. And helped 33 IR cases for our customers. You could imagine all the above data contributing to our intelligence reports. Generally speaking, most of them show a tendency of increasing.

TeamT5 is actively tracking vulnerability exploitation attacks in the wild. In 2024, 30 widespread attacks were tracked by TeamT5, around 400 victim hosts across 21 countries were identified to be compromised.

We would like to highlight that 5 of them are email system related and 14 are exploiting edge devices, indicating they are high priorities of threat actors to access targets. Our research also shows EtherBei (aka Flax Typhoon) to be the most active threat actors to adopt these exploits.

During the course of our research, we also discovered some threat actors built their botnet or so called Operation Relay Box network by implanting malware like GobRAT, NatWalk and GenSeven.

Lastly, there’s also a tendency that more management services of edge devices are being exploited, such as FortiManager, Versa Director or Palo Alto Firewall, e.t.c., meaning that threat actors might compromise multiple entities by intruding on one device. We believe this is a threat that management service providers or big enterprises should be aware of.

![](https://uploads.teamt5.org/upload/original/pic1_apt-threat-landscape-in-apac-2024.png)

 

>本篇文章為節錄版，摘述關鍵數據與威脅情資分析。欲取得完整《2024年威脅態勢回顧: 網路攻擊的模糊地帶》報告，您可以直接填寫文章末尾表格，我們將透過電子郵件、寄送給您。

>欲探索更多亞太地區的威脅情資，立刻申請獲得國際顧問公司肯定的威脅情資平台 ThreatVision 試用機會。請在 [ThreatVision 頁面](https://teamt5.org/tw/products/threatvision/?utm_source=blog&utm_medium=website) 說明您希望申請試用。

2024年威脅態勢回顧: 網路攻擊的模糊地帶【英文威脅情資報告】

>TeamT5 is a leading brand in delivering Asia Pacific intelligence. In this article, we summarize the threat landscape of advanced persistent threats (APT) in the Asia-Pacific region in 2024, not only provide annual observations, but also point out the cyber threats worth paying attention to in 2024.

>This article is an excerpt version which summarizes key statistics. **To obtain the complete threat intelligence report, you may fill up the form at the bottom to obtain the “APT Threat Landscape in APAC 2024: Blurred Lines of Cyber Attacks” report.**

>To discover similar cyber threat intelligence which is focused in the Asia-Pacific region, please sign up for the trial of our award-winning threat intelligence platform ThreatVision. Please indicate on the [ThreatVision page](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website) that you would like to apply for trial.

##Threat Statistics in 2024: Data & Observations

In 2024, until the end of November, TeamT5 actively tracked 30 new vulnerabilities being exploited in the wild, along with around 500 attack operations across 42 countries, which we attributed to 73 known adversaries and more than 200 malware / hacking tools being used. 

We also identified 45 victims being compromised in 9 countries and tried to notify through our trustworthy partners. And helped 33 IR cases for our customers. You could imagine all the above data contributing to our intelligence reports. Generally speaking, most of them show a tendency of increasing.

TeamT5 is actively tracking vulnerability exploitation attacks in the wild. In 2024, 30 widespread attacks were tracked by TeamT5, around 400 victim hosts across 21 countries were identified to be compromised.

We would like to highlight that 5 of them are email system related and 14 are exploiting edge devices, indicating they are high priorities of threat actors to access targets. Our research also shows EtherBei (aka Flax Typhoon) to be the most active threat actors to adopt these exploits.

During the course of our research, we also discovered some threat actors built their botnet or so called Operation Relay Box network by implanting malware like GobRAT, NatWalk and GenSeven.

Lastly, there’s also a tendency that more management services of edge devices are being exploited, such as FortiManager, Versa Director or Palo Alto Firewall, e.t.c., meaning that threat actors might compromise multiple entities by intruding on one device. We believe this is a threat that management service providers or big enterprises should be aware of.

![](https://uploads.teamt5.org/upload/original/pic1_apt-threat-landscape-in-apac-2024.png)

>This article is an excerpt version which summarizes key statistics. To obtain the complete threat intelligence report, you may fill up the form at the bottom to obtain the “APT Threat Landscape in APAC 2024: Blurred Lines of Cyber Attacks” report.

>To discover similar cyber threat intelligence which is focused in the Asia-Pacific region, please sign up for the trial of our award-winning threat intelligence platform ThreatVision. Please indicate on the [ThreatVision page](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website) that you would like to apply for trial.


APT Threat Landscape in APAC 2024: Blurred Lines of Cyber Attacks

>TeamT5は、アジア太平洋地域(APAC)における脅威インテリジェンスを専門とするセキュリティベンダーです。 本記事では、2024年のAPACにおけるAPT（Advanced Persistent Threats：高度標的型攻撃）の脅威状況をまとめ、毎年恒例のレビューだけでなく、今後1年間注意すべきセキュリティ脅威についてもご紹介します。

>本記事は、主要データと脅威インテリジェンス分析を要約したものです。 **「2024年脅威ランドスケープのレビュー：曖昧になるサイバー攻撃の境界線」全文の閲覧をご希望の方は、下部のフォームにご記入ください**。

>アジア太平洋地域の脅威インテリジェンスについてさらに詳しく知りたい方は、国際的なコンサルタントから受賞歴のある脅威インテリジェンスプラットフォームThreatVisionのトライアルを申し込むことが出来ます。[ThreatVision](https://teamt5.org/jp/products/threatvision/?utm_source=blog&utm_medium=website)のページよりトライアルを希望する旨をご記入ください。

##Threat Statistics in 2024: Data & Observations

In 2024, until the end of November, TeamT5 actively tracked 30 new vulnerabilities being exploited in the wild, along with around 500 attack operations across 42 countries, which we attributed to 73 known adversaries and more than 200 malware / hacking tools being used. 

We also identified 45 victims being compromised in 9 countries and tried to notify through our trustworthy partners. And helped 33 IR cases for our customers. You could imagine all the above data contributing to our intelligence reports. Generally speaking, most of them show a tendency of increasing.

TeamT5 is actively tracking vulnerability exploitation attacks in the wild. In 2024, 30 widespread attacks were tracked by TeamT5, around 400 victim hosts across 21 countries were identified to be compromised.

We would like to highlight that 5 of them are email system related and 14 are exploiting edge devices, indicating they are high priorities of threat actors to access targets. Our research also shows EtherBei (aka Flax Typhoon) to be the most active threat actors to adopt these exploits.

During the course of our research, we also discovered some threat actors built their botnet or so called Operation Relay Box network by implanting malware like GobRAT, NatWalk and GenSeven.

Lastly, there’s also a tendency that more management services of edge devices are being exploited, such as FortiManager, Versa Director or Palo Alto Firewall, e.t.c., meaning that threat actors might compromise multiple entities by intruding on one device. We believe this is a threat that management service providers or big enterprises should be aware of.

![](https://uploads.teamt5.org/upload/original/pic1_apt-threat-landscape-in-apac-2024.png)

>本記事は、主要データと脅威インテリジェンス分析を要約したものです。 「2024年脅威ランドスケープのレビュー：曖昧になるサイバー攻撃の境界線」全文の閲覧をご希望の方は、下部のフォームにご記入ください。

>アジア太平洋地域の脅威インテリジェンスについてさらに詳しく知りたい方は、国際的なコンサルタントから受賞歴のある脅威インテリジェンスプラットフォームThreatVisionのトライアルを申し込むことが出来ます。[ThreatVision](https://teamt5.org/jp/products/threatvision/?utm_source=blog&utm_medium=website)のページよりトライアルを希望する旨をご記入ください。


2024年脅威ランドスケープのレビュー：曖昧になるサイバー攻撃の境界線【脅威インテリジェンスレポート(英語ver.)】

Threat Intelligence

**Threat intelligence**, also known as cyber threat intelligence (CTI), is a critical aspect of cybersecurity, involving the collection, processing, and analysis of data about potential or current threats to an organization's security. This intelligence is not just raw data but contextual information that helps in understanding threat actors' motives, targets, and attack behaviors. It provides insights into the tactics, techniques, and procedures (TTPs) of adversaries, enabling organizations to prepare, prevent, and identify cyber threats that could exploit valuable resources.

**This whitepaper will give you overall understanding of threat intelligence and how threat intelligence points out the threat landscape**. It contains:
- Introduction to Threat Intelligence
- Challenges & the Role of Threat Intelligence
- Types of Threat Intelligence
- The Threat Intelligence Lifecycle
- Implementing Threat Intelligence
- Threat Intelligence in Action
- Future Trends & Developments

 

**Fill up the form and receive our whitepaer now!**

[The New York Times] China Is Hacking Russia to Steal War Secrets

Related Post

APT Threat Landscape in APAC 2024: Blurred Lines of Cyber Attacks

[Whitepaper] Understanding Threat Intelligence & The Threat Landscape with TeamT5