In late March, TeamT5 detected that the China-nexus APT group exploited the critical vulnerability in Ivanti Connect Secure VPN appliances to infiltrate multiple entities around the globe. The victims include nearly twenty different industries across twelve countries. We believe that the actor still maintained control over the victim's network at the time of analysis.

## Victimology
**The victim countries** include Austria, Australia, France, Spain, Japan, South Korea, Netherlands, Singapore, Taiwan, the United Arab Emirates, the United Kingdom, and the United States. **The targeted industries** include Automotive, Chemical, Conglomerate, Construction, Information Security, Education, Electronics, Financial Institution, Gambling, Government, Intergovernmental Organizations (IGO), Information Technology, Law Firm, Manufacturing, Materials, Media, Non-Governmental Organizations (NGOs), Research Institute, Telecommunication.

## Threat Details
Our analysis assessed with high confidence that the actor was exploiting the vulnerabilities of Ivanti Connect Secure VPN appliances to launch attacks around the globe. The actor possibly exploited CVE-2025-0282[1] or CVE-2025-22457[2] to conduct initial access.

Both CVE-2025-0282 and CVE-2025-22457 are stack buffer overflow vulnerabilities in Ivanti Connect Secure VPN with a CVSS score of `9.0`. Successful exploitation allows the threat actor to achieve remote code execution, leading to intrusion of the internal network and malware implantation.

In the attack, the actor deployed a shared weapon among Chinese threat groups, SPAWNCHIMERA. SPAWNCHIMERA is developed specifically for Ivanti Connect Secure VPN and has all the functionalities of the notorious SPAWN family, including SPAWNANT (installer), SPAWNMOLE (socks5 tunnler), SPAWNSNAIL (SSH backdoor), and SPAWNSLOTH (log wiper).

Moreover, our analysis suggests that other threat actors might also obtain the vulnerability information and start campaigns targeting Ivanti VPN appliances. We have observed massive exploitation attempts against Ivanti VPN appliances since April. Although most exploitation attempts failed, many Ivanti VPN appliances became paralyzed and unstable. 

TeamT5 strongly recommends that affected organizations conduct a thorough incident investigation. Given the versatile TTPs of the actor, such as multi-layers of C2 infrastructure, evasion of monitor mechanism, and the usage of log wiper, without additional technical support, it would be a challenge to detect the actor’s malicious traces inside the network. 

Contact us for assistance - [https://teamt5.org/en/contact-us/](https://teamt5.org/en/contact-us/?utm_source=blog&utm_medium=website).

 
 

[1]
[CVE-2025-0282](https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283?language=en_US)

[2] 
[CVE-2025-22457](https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457?language=en_US)

China-nexus APT exploits Ivanti Connect Secure VPN vulnerability to infiltrate multiple entities

3 月底，TeamT5 的遙測察知中國相關 APT 族群利用 Ivanti Connect Secure VPN 高風險漏洞發動攻擊，受害單位橫跨全世界 12 個國家，近 20 個不同產業。截至分析時，我們確信攻擊者仍持續控制受害者的網路。

## 受害單位
**受害國家**奧地利、澳洲、法國、西班牙、日本、南韓、荷蘭、新加坡、台灣、英國、美國、阿拉伯聯合大公國。而**受害產業**則包括汽車、化學、電信、營造、資安、教育、電子、金融、博弈、政府、法律、製造、媒體、企業集團、跨政府組織、非政府組織、資訊科技、研究機構。

## 威脅細節
我們的分析持高度信心攻擊者是利用 Ivanti Connect Secure VPN 相關的高風險漏洞展開攻擊。根據我們目前掌握的資訊，攻擊者可能是利用 CVE-2025-0282[1] 或 CVE-2025-22457[2] 取得初步存取權限。

CVE-2025-0282 和 CVE-2025-22457 都是 Ivanti Connect Secure VPN 的堆疊緩衝區溢位（stack buffer overflow）漏洞，CVSS 分數為 `9.0`。漏洞成功利用後，威脅行動者便得以實現遠端程式碼執行，進而入侵內部網路和部署惡意程式。

在這起攻擊中，攻擊者部署的是中國威脅族群的共用惡意程式 SPAWNCHIMERA。SPAWNCHIMERA 是專為 Ivanti Connect Secure VPN 所開發，具備 SPAWN 家族惡意程式的所有功能，包括 SPAWNANT （安裝程式）、SPAWNMOLE（socks5 網路隧道程式）、SPAWNSNAIL（SSH 後門程式）和 SPAWNSLOTH（記錄抹除程式）。

此外，我們的分析研判，其他威脅行動者可能也有取得漏洞相關資訊，並著手展開針對 Ivanti VPN 設備的攻擊行動。自 4 月以來，我們發現針對 Ivanti VPN 設備的大規模漏洞攻擊嘗試。雖然絕大多數的漏洞攻擊嘗試都以失敗告終，但卻也造成這些 Ivanti VPN 設備被癱瘓且變得不穩定。

TeamT5 建議受影響單位應即刻展開完整的事件調查。基於攻擊者手法的多變性，如多層次 C2 基礎架構、監控機制迴避與使用記錄抹除程式，若缺乏額外的技術協助，恐不易深入調查內部網路的攻擊者足跡。若需任何進一步的技術協助，可[直接聯繫 TeamT5](https://teamt5.org/tw/contact-us/?utm_source=blog&utm_medium=website)。

 
 

[1]
[CVE-2025-0282](https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283?language=en_US)

[2] 
[CVE-2025-22457](https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457?language=en_US)

中國相關威脅行動者利用 Ivanti Connect Secure VPN 漏洞滲透多國單位

Threat Intelligence

【案例分析】針對近期醫療院所面對 CrazyHunter 勒索軟體攻擊事件技術過程探討說明

[Case Study] CrazyHunter Ransomware Attacks Targeted Taiwan Hospitals

Products & Services

>近期醫療院所遭遇勒索軟體攻擊的事件頻傳，衛福部發出[公告](https://www.mohw.gov.tw/cp-16-81726-1.html)，將此事件定義為「系統性攻擊」，不排除其他醫院可能成為下一個目標。
>本篇文章說明應變勒索軟體的重要原則，協助企業與組織有效應變。

 
繼 2 月初馬偕醫院遭勒索軟體組織 CrazyHunter 攻擊後，3 月初彰化基督教醫院也遭勒索攻擊。經衛福部召集相關廠商調查確認後，證實亦為 CrazyHunter 勒索軟體組織。TeamT5 對於此一連續攻擊事件，均及時掌握威脅情況，並彙整惡意程式 IoC 情資，由 TeamT5 MDR 團隊主動協助雲端客戶，完成清查所屬場域端點狀況，目前均無遭勒索惡意程式攻擊的跡象。

面對勒索軟體攻擊，企業第一時間應隔離受駭設備，防止病毒擴散；接下來評估影響範圍，確認是否有可用備份，並向資安專家團隊或執法單位尋求協助。同時呼籲切勿輕易支付贖金，因為此舉不僅無法保證資料解鎖、系統恢復，還可能助長攻擊者的勒索行為。

最重要的是，企業應強化資安防禦，例如採用端點偵測及回應軟體（EDR），全時監控企業組織內的端點；若偵測到異常行為，EDR 可即時阻擋勒索軟體惡意攻擊。

臺灣在地廠商 TeamT5 自主研發的 [ThreatSonar Anti-Ransomware 威脅鑑識分析與回應平台](https://teamt5.org/tw/products/threatsonar-anti-ransomware/?utm_source=blog&utm_medium=website)，專為協助阻擋勒索軟體而設計，藉由引擎自我學習機制，自動判斷常用程式或新進惡意程式，有效掃描被加密檔案。該平台更獲得[國際大展 COMPUTEX - Best Choice Award 金獎肯定](https://bcaward.computex.biz/WinnerYearDetail.aspx?index=9390&awtype=000000001&year=2024&sort=2)，能為企業與組織提供及時偵測、立即攔截威脅攻擊、掌握攻擊路徑，以利快速應對資安事件，並採取防護措施。

完成 ThreatSonar Anti-Ransomware 簡易部署後，企業即可有效防禦勒索軟體，避免近期頻傳的同類資安事件發生。下方說明 ThreatSonar Anti-Ransomware 如何成功防堵勒索攻擊。

 

![](https://uploads.teamt5.org/upload/original/how-hospitals-deal-with-ransomware-attacks_1.JPG)

<center>ThreatSonar Anti-Ransomware 預設勒索軟體偵測機制，可自動發出即時告警、移除程式等。</center>

![](https://uploads.teamt5.org/upload/original/how-hospitals-deal-with-ransomware-attacks_2.png)

<center>當偵測到勒索軟體開始執行， ThreatSonar Anti-Ransomware 立即阻斷，終止程式執行。</center>

![](https://uploads.teamt5.org/upload/original/how-hospitals-deal-with-ransomware-attacks_3.JPG)

<center>ThreatSonar Anti-Ransomware 掌握到勒索攻擊後，於「事件」報告頁面顯示攻擊路徑。</center>

![](https://uploads.teamt5.org/upload/original/how-hospitals-deal-with-ransomware-attacks_4.JPG)

<center>ThreatSonar Anti-Ransomware 即時阻擋，成功防堵勒索軟體攻擊。</center>

 

<center>
<iframe width="560" height="315" src="https://www.youtube.com/embed/G2BD3PE2mO4?si=qKWiasWIty352h2K" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>
</center>

<center>ThreatSonar Anti-Ransomware 即時偵測阻擋 CrazyHunter 勒索軟體攻擊【示範影片】</center>

 

面對未知且嚴重的勒索軟體攻擊事件，TeamT5 建議仍須提前因應，以下為預防、偵測與應變處理的各項對應措施：
- 檢視外部系統及 VPN 設備之權限控管狀態是否嚴謹。
- 針對網路存取規則及帳號權限原則，確認是否符合最小權限設計。
- 確認資料備份還原機制是否完善，且無法遭攻擊者控制清除。
- 落實系統、設備弱點管理與修補作業，並強化端點防護機制。
- 關注網路威脅情資，及早因應並強化可能遭受攻擊的弱點。
- 建立事件應變處理計畫。

 


>TeamT5 已協助多家國內外企業處理勒索事件攻擊，由獲獎團隊偕同企業一同應變，防禦多元的惡意程式入侵、抵擋持續演進的攻擊手法。 
>今天就[聯絡我們](https://teamt5.org/tw/contact-us/?utm_source=blog&utm_medium=website)，洽詢試用。

>- [防禦交給專家 威脅精準應對：TeamT5 威脅偵測應變代管服務獲資安精品獎殊榮](https://teamt5.org/tw/posts/teamt5-cybersecurity-managed-service-wins-2024-cyber-security-innovation-award-for-helping-enterprises-respond-to-cyber-threats/?utm_source=blog&utm_medium=website) 
>- [TeamT5 威脅偵測應變代管服務（MDR）介紹](https://teamt5.org/tw/service/mdr/?utm_source=blog&utm_medium=website)

TeamT5 及時掌握 CrazyHunter 勒索軟體攻擊事件【示範影片】

>Recently, medical institutions in Taiwan have been frequently attacked by ransomware. The Ministry of Health and Welfare (MOHW) has issued a [notice](https://www.mohw.gov.tw/cp-16-81726-1.html) defining this incident as a "systemic attack" and does not rule out the possibility that other hospitals may become the next target.

>This article explains the important principles of responding to ransomware to help companies and organizations respond effectively.

 

After Mackay Memorial Hospital was attacked by the ransomware organization CrazyHunter in early February, Changhua Christian Hospital was also attacked by ransomware in early March. After MOHW convened relevant vendors for investigation and confirmation, it was confirmed that the March attack was also done by CrazyHunter. TeamT5 has promptly grasped the threat situation and compiled IoC intelligence of the malware for the serial attacks. The TeamT5 Managed Detection and Response (MDR) team proactively assisted cloud customers to complete a thorough scanning covering all endpoints in their environments. Currently, there are no signs of ransomware attacks.

When faced with a ransomware attack, companies should first isolate the compromised devices to prevent the malware from spreading; then assess the scope of impact, confirm whether there are available backups, and seek assistance from cybersecurity expert teams or law enforcement agencies. At the same time, we would like to urge everyone not to pay the ransom in the first place, because doing so will not only be unable to guarantee data decryption and system recovery, but may also encourage attackers' extortion behavior.

Most importantly, companies should strengthen their cybersecurity defenses, such as using endpoint detection and response (EDR) software to monitor endpoints within the organization at all times. If abnormal behavior is detected, EDR can immediately block malicious ransomware attacks.

The [ThreatSonar Anti-Ransomware](https://teamt5.org/en/products/threatsonar-anti-ransomware/?utm_source=blog&utm_medium=website) are independently developed by Taiwan local cybersecurity company TeamT5, which are designed specifically to help block ransomware. Through the engine's self-learning mechanism, it automatically determines commonly used programs or new malware and effectively scans encrypted files. The platform has also won the [Gold Award of Computex Best Choice Award](https://bcaward.computex.biz/WinnerYearDetail.aspx?index=9390&awtype=000000001&year=2024&sort=2) at the international exhibition COMPUTEX TAIPEI. It provides companies and organizations with timely detection, immediate interception of threat attacks, as well as visibility into attack paths, facilitating quick response to incidents and taking protective measures.

After completing the simple deployment of ThreatSonar Anti-Ransomware, companies can effectively defend against ransomware and avoid similar incidents that have occurred recently. The video below shows how ThreatSonar successfully blocks a ransomware attack.


![](https://uploads.teamt5.org/upload/original/how-hospitals-deal-with-ransomware-attacks_en_1.JPG)
<center>ThreatSonar Anti-Ransomware has a default ransomware detection mechanism 
that can automatically issue real-time alerts, remove programs, etc.</center>

![](https://uploads.teamt5.org/upload/original/how-hospitals-deal-with-ransomware-attacks_en_2.JPG)
<center>When the ransomware is detected to start running, 
ThreatSonar Anti-Ransomware immediately blocks it and terminates the program execution.</center>

![](https://uploads.teamt5.org/upload/original/how-hospitals-deal-with-ransomware-attacks_en_3.JPG)
<center>Once ThreatSonar Anti-Ransomware detects a ransomware attack, 
it displays the attack path on the "Incidents" page.</center>

![](https://uploads.teamt5.org/upload/original/how-hospitals-deal-with-ransomware-attacks_en_4.JPG)
<center>ThreatSonar Anti-Ransomware blocks ransomware attacks in real time.</center>

 
<center>How Does ThreatSonar Anti-Ransomware Block CrazyHunter Ransomware Attacks? [Demo Video]</center>

<center>
<iframe width="560" height="315" src="https://www.youtube.com/embed/El8a6CubpkI?si=mqSEAYV5hMfvlJ34" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>
</center>

 

In the face of unknown and serious ransomware attacks, TeamT5 urges companies and organizations to prepare in advance. 

The following are the measures for prevention, detection and response:
- Check whether the permission control status of external systems and VPN devices is solid.
- Confirm whether network access rules and account permission policies comply with the least privilege principles.
- Confirm whether the mechanism of data backup and restoration is complete and is not likely to be controlled and cleared by attackers.
- Implement vulnerability and patch management processes for system and device, and strengthen endpoint protection measures.
- Stay informed on cyber threat intelligence, prepare in advance and rectify weaknesses that may be attacked. 
- Establish an incident response process.

 

>TeamT5 has assisted many local and international companies in dealing with ransomware attacks. The award-winning team is the most reliable partner for companies in responding to incidents, defending diverse malware intrusions and shielding against the evolving attacks.

>[Contact us](https://teamt5.org/en/contact-us/?utm_source=blog&utm_medium=website) today for a free trial.

TeamT5 Timely Copes with CrazyHunter Ransomware Attacks [Demo Video]

>近年、台湾の医療機関はランサムウェアによる攻撃を頻繁に受けています。[衛生福利部（MOHW）はこのインシデントを「組織的な攻撃」](https://www.mohw.gov.tw/cp-16-81726-1.html)と定義する通達を発表しており、他の病院が次の標的となる可能性もあります。
>
>この記事では、企業や組織がランサムウェアに効果的に対応するための重要な原則について解説します。


2月上旬に馬偕記念病院がランサムウェア組織CrazyHunterの攻撃を受けた後、3月上旬にも彰化基督教病院がランサムウェアの攻撃を受けました。MOHWが関連ベンダーを招集して調査と確認を行った結果、3月の攻撃もCrazyHunterによるものであることが確認されました。TeamT5はこの脅威状況を迅速に把握し、連続攻撃のマルウェアのIoCインテリジェンスをまとめました。TeamT5のMDR（Managed Detection and Response）チームは、クラウド顧客が環境内のすべてのエンドポイントを網羅する徹底的なスキャンを完了できるよう、積極的に支援しました。なお、現在はランサムウェア攻撃の兆候はありません。


ランサムウェア攻撃に直面した場合、企業はまずマルウェアの拡散を防ぐために感染したデバイスを隔離し、影響が及ぶ範囲を想定、そして利用可能なバックアップがあるかどうかの確認を行い、サイバーセキュリティの専門家チームや法執行機関に支援を求める必要があります。なぜなら、身代金を支払うことは、データの復号化とシステムの回復を保証できないだけでなく、攻撃者の恐喝行為を助長する可能性があるからです。


最も重要なことは、企業はサイバーセキュリティの防御を強化することです。例えば、エンドポイント検出応答（EDR）ソフトウェアを使用して、組織内のエンドポイントを常時監視することです。EDRは異常な動作が検出された場合、悪意のあるランサムウェア攻撃を即座にブロックすることが可能です。


[ThreatSonar Anti-Ransomware](https://teamt5.org/jp/products/threatsonar-anti-ransomware/?utm_source=blog&utm_medium=website) は、台湾の現地サイバーセキュリティ企業TeamT5が独自に開発したもので、ランサムウェアのブロックに特化して設計されています。エンジンの自己学習メカニズムにより、頻繁に使用されるプログラムや新しいマルウェアを自動的に判断し、暗号化されたファイルを効果的にスキャンします。このプラットフォームは、[国際展示会COMPUTEX TAIPEIでComputex Best Choice Awardの金賞](https://bcaward.computex.biz/WinnerYearDetail.aspx?index=9390&awtype=000000001&year=2024&sort=2)も受賞しています。また、同プラットフォームは、企業や組織にタイムリーな検知、脅威攻撃の即時遮断、攻撃経路の可視化を提供しており、インシデントへの迅速な対応と保護措置を促進します。




ThreatSonar Anti-Ransomware の導入は簡単に行うことができ、企業はランサムウェアから効果的に防御し、最近発生した同様のインシデントを回避することができます。以下のビデオでは、ThreatSonarがランサムウェア攻撃のブロックに成功した例を紹介しています。

 
![](https://uploads.teamt5.org/upload/original/how-hospitals-deal-with-ransomware-attacks_en_1.JPG)
<center>ThreatSonar Anti-Ransomware はランサムウェア検出メカニズムを持っており、自動的にリアルタイムのアラートを発したり、プログラムを削除したりすることができます。</center>

 
![](https://uploads.teamt5.org/upload/original/how-hospitals-deal-with-ransomware-attacks_en_2.JPG)
<center>ランサムウェアが検出されると、ThreatSonar Anti-Ransomware は直ちにランサムウェアをブロックし、プログラムの実行を終了します。</center>

 
![](https://uploads.teamt5.org/upload/original/how-hospitals-deal-with-ransomware-attacks_en_3.JPG)
<center>ThreatSonar Anti-Ransomware がランサムウェア攻撃を検出すると、「インシデント」ページに攻撃パスが表示されます。</center>

 
![](https://uploads.teamt5.org/upload/original/how-hospitals-deal-with-ransomware-attacks_en_4.JPG)
<center>ThreatSonar Anti-Ransomware は、ランサムウェア攻撃をリアルタイムでブロックします。</center>

 

<center>
<iframe width="560" height="315" src="https://www.youtube.com/embed/NLNU_I10C5o?si=NK2UIek8QCvr7arI" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>
</center>

<center>ThreatSonar Anti-RansomwareはどのようにCrazyHunterランサムウェア攻撃をブロックするのでしょうか？</center>

 

TeamT5は企業や組織に向け、未知で深刻なランサムウェア攻撃に対し事前対策を取ることを推奨します。予防、検知、対応策として以下が挙げられます：
- 外部システムやVPNデバイスの権限管理状況がしっかりしているかの確認
- ネットワークアクセスルールとアカウント権限ポリシーが最小権限の原則に準拠しているかの確認
- データのバックアップやリストアの仕組みが万全で、攻撃者に制御・消去される可能性がないかの確認
- システムやデバイスの脆弱性対策やパッチ管理プロセスを実施し、エンドポイント保護対策を強化
- サイバー脅威インテリジェンスに関する情報を収集して事前準備を行い、攻撃される可能性のある弱点を是正
- インシデント対応プロセスを確立

 

>TeamT5は、ランサムウェア攻撃への対応において、国内外の多くの企業を支援してきました。受賞歴のある当社チームは、インシデントへの対応、多様なマルウェアの侵入や進化する攻撃からの防御に秀でており、企業にとって最も信頼できるパートナーです。

>[無料トライアルはこちらから](https://teamt5.org/jp/contact-us/?utm_source=blog&utm_medium=website)

TeamT5、CrazyHunterランサムウェア攻撃に適時対処

針對近日醫療院所遭到勒索軟體攻擊事件，TeamT5 觀察到勒索軟體組織 CrazyHunter，透過自帶合法驅動程式 zam64.sys（電腦惡意軟體即時防護軟體 Zemana AntiMalware），來提升權限，並透過 AD GPO 機制散播勒索軟體，達到加密端點主機資料目的。

此一攻擊過程，將可能讓攻擊者在取得系統權限後，得以停用場域端點防護機制（EDR），使攻擊行為無法在第一時間被偵測阻擋，並可刪除系統還原保護機制與加密端點上所有資料檔案，從而衍生資料外洩等疑慮。故 [TeamT5 CSIRT](https://teamt5.org/tw/posts/teamt5-csirt/?utm_source=news&utm_medium=website) & PSIRT 立即採取行動，協助客戶及合作夥伴應對防範，也為大眾提出該類事件的處置建議。

##TeamT5 採取的行動
###威脅分析
事件樣本經 TeamT5 威脅情資團隊分析後發現，該勒索軟體是基於 Prince Ransomware 所開發。再進一步追蹤所關聯的惡意程式後，發現開發資訊有簡體中文，可辨別攻擊者的來源；另勒索軟體利用群組原則物件（Group Policy Object, GPO）散播所使用之工具為 SharpGPOAbuse，攻擊者於內網滲透時常用此工具來對 AD 操作，進一步控制企業網路。

###服務監控
TeamT5 MDR 服務團隊已主動針對事件 IoC（詳見參考資訊），巡檢客戶場域是否有存在相關惡意程式狀況，並檢視場域端點報告及活動紀錄，確保無潛在威脅存在。目前 TeamT5 所維護場域，尚無遭此事件影響狀況。

###產品偵測
針對本次事件中勒索軟體所利用之驅動程式（zam64.sys），已在 TeamT5 的 ThreatSonar Anti-Ransomware 偵測防護名單中，可有效偵測阻擋，確保不被攻擊者利用。另針對未知勒索軟體，ThreatSonar Anti-Ransomware 亦有偵測防護機制，可阻擋勒索加密行為。

 

##TeamT5 建議處置措施
面對 APT 及勒索軟體攻擊事件頻傳，TeamT5 建議場域仍需強化下列防護與應對措施：

- 在資安事件 IoC 發布時，應立即將情資匯入資安防護設備與平台中，主動偵掃確認是否有隱藏威脅存在。
- 掌握場域中網路終端設備、對外服務系統、內部核心 AD 管理與端點系統威脅情資，檢視可能發生之攻擊行為並導入相關防護機制，降低攻擊發生成功機率。
- 針對場域資安事件應變處理過程，建議透由「事前檢視預防」、「事中防護阻擋」與「事後復原強化」來面對可能發生之網路攻擊威脅，並將相關事證保留進行調查。
- 諮詢 TeamT5 威脅情資及事件處理服務團隊，協助檢視場域可能威脅，提早規劃應對方案，例如：
 - 採用 TeamT5 [ThreatVision 威脅情資平台](https://teamt5.org/tw/products/threatvision/?utm_source=blog&utm_medium=website)，關注最新網路攻擊威脅情資及[深暗網威脅情資](https://teamt5.org/tw/products/deep-dark-web-intelligence/?utm_source=blog&utm_medium=website)，掌握可能波及的攻擊情況及系統外洩帳密、資料洩露狀況，及時找出可能已遭入侵之破口，立即修補弱點，防範災情擴大。
 - 檢視場域網路系統架構與評估曝險狀況，針對核心系統如 Web、Email、ERP 及 AD 等與作業端點，導入 [ThreatSonar Anti-Ransomware 端點威脅鑑識分析與回應平台](https://teamt5.org/tw/products/threatsonar-anti-ransomware/?utm_source=blog&utm_medium=website)，確保場域端點環境安全，並第一時間偵測回應與阻擋駭客攻擊威脅。

 

##TeamT5 的承諾
為確保客戶場域環境安全，TeamT5 提供多樣化的服務，以滿足客戶不同的安全需求，並始終以確保客戶系統安全作為優先事項。如有任何進一步的問題或需要更多資訊，請隨時與我們聯繫。



 

- 參考資訊：[衛福部資安資訊分享與分析中心：近期部分醫院遭勒索病毒攻擊，請各院加強戒備](https://hisac.nat.gov.tw/news?265)

 

>杜浦數位安全電腦資安事件應變小組與產品資安事件應變小組（[TeamT5 CSIRT](https://teamt5.org/tw/posts/teamt5-csirt/?utm_source=news&utm_medium=website) & PSIRT）主要提供客戶有關資安事件偵測、通報與應變處理服務，過程中會與客戶的 IT 及資安團隊進行密切配合，並於事前提供客戶面對網路威脅所需情資及專業工具，協助辨識與防禦威脅，事中進行偵測與因應與事後復原強化等服務。 
>
>IR 資安事件應變服務: [介紹](https://teamt5.org/tw/service/ir/?utm_source=blog&utm_medium=website) 
>MDR 威脅偵測應變代管服務: [介紹](https://teamt5.org/tw/service/mdr/?utm_source=blog&utm_medium=website) 
>
>若您有資安事件處理、應變的需求，歡迎填寫[諮詢表單](https://teamt5.org/tw/contact-us/?utm_source=blog&utm_medium=website)。

如何應對 CrazyHunter 勒索軟體攻擊事件【TeamT5 詳解】

TeamT5, a provider of top cyber threat intelligence and endpoint detection and response (EDR) solutions in APAC, is going to showcase solutions at upcoming innovation event InnoVEX (part of COMPUTEX).

We believe that threat intelligence is the cornerstone of cyber defense. We provide action-oriented and localized intelligence to help enterprises foresee cyber attacks and deploy defense strategies in advance. We sincerely welcome you to experience our intelligence-driven cyber defense at booth.

## Our Solutions
### ThreatVision, a powerful threat intelligence platform 
**Advantages**:
1. Grasp latest & advanced cyber threats 
2. Boost power to defend cyber attacks 
3. Expand insights & database for Advanced Persistent Threat (APT)

**Intro**:

Grow your business in a threat-free environment with our intuitive interface. Further analysis is upon request and conducted by our 20+ years’ experience analysts.

Mitigate your risk with our in-depth research on Advanced Persistent Threat (APT) activities and cyber threat intelligence analysis.

With one glimpse at our internet threat map, you’re able to understand aggregated risk information across the global network. With our cyber risk scoring, you’re able to quickly identify the threat level of a specific IP address or domain name. Enterprises can always stay proactive with our threat intelligence.

More at [ThreatVision](https://teamt5.org/en/products/threatvision/?utm_source=blog&utm_medium=website)

 

## ThreatSonar, a cyber threat forensic & analysis platform 
**Advantages**: 
1. Assess system compromised events more precisely
2. Respond to cyber incidents faster
3. Deploy the tool automatically

**Intro**:

ThreatSonar is an easy-to-use tool to hunt cyber threats. Combining digital forensics and behavior-modeling techniques, ThreatSonar can do fast triage and hunt for anomalies.

Drive by cyber threat intelligence and run with automatic mode, it finds hidden infections with similar TTPs - Tactics, Techniques, and Procedures. Regular cybersecurity check-ups also help enterprises to better protect endpoints.

ThreatSonar offers both online and offline mode to protect endpoints in various situations. In short, ThreatSonar is an effective tool designed for assisting incident response.

More at [ThreatSonar](https://teamt5.org/en/products/threatsonar?utm_source=blog&utm_medium=website)


## TeamT5 at InnoVEX
- Date: 2025 / 5 / 20～23
- Time: 9:30 ~ 17:30
- Venue: Taipei Nangang Exhibition Center - Hall 2, Taiwan
- Booth Number: S1025a


![](https://uploads.teamt5.org/upload/original/pic_teamt5-will-showcase-solutions-at-2025-innovex.png)

TeamT5 will showcase solutions at 2025 InnoVEX (COMPUTEX) 

TeamT5 杜浦數位安全 為亞太威脅情資的頂尖品牌，即將於 COMPUTEX 聯合展「亞洲指標新創展 InnoVEX」展出威脅情資平台 ThreatVision、威脅鑑識分析平台 ThreatSonar。


TeamT5 杜浦數位安全相信威脅情資是網路防禦的基石。我們提供行動導向的在地化情報，幫助企業和組織提前預見網路攻擊並部署防禦策略。歡迎蒞臨現場，了解我們的威脅情資見解與解決方案。


## 我們的解決方案
### ThreatVision 威脅情資平台

#### 優點：
- 掌握最新、技術先進的資安威脅
- 增強防禦資安攻擊的能力
- 擴展進階持續性威脅（APT） 的見解和資料庫

#### 簡介：
憑藉針對亞太地區惡意程式、APT（進階持續性威脅）族群和網路威脅的十多年研究經驗，ThreatVision 威脅情資平台專為組織，提供以亞太地區為中心的豐富網路威脅情資。平台透過提供戰略、營運和戰術威脅情資，來滿足網路安全領域的不同角色，包括決策者、風險管理者和事件應變人員，協助 C 層級高階經理人、風險經理和事件處理人員了解威脅形勢、識別惡意行為者並部署有效的網路威脅防禦。

ThreatVision 提供可客製情資調查與諮詢服務，以及其易於使用的介面和精選報告，協助組織能做出明智的決策，有效地分配資安資源，並增強網路安全。

更多介紹，請見： [ThreatVision 威脅情資平台](https://teamt5.org/tw/products/threatvision/?utm_source=blog&utm_medium=website)

 


### ThreatSonar 威脅鑑識分析平台
#### 優點：
- 更準確地評估系統入侵事件
- 更快地回應資安事件
- 平台可自動部署

#### 簡介：
ThreatSonar 是一款易於使用的資安威脅工具。 ThreatSonar 結合數位取證和行為建模技術，可以快速分類並尋找異常情況。

ThreatSonar 基於 TeamT5 團隊對全球惡意程式研究的成果，內建惡意行為指標、軟體後門特徵，並結合智慧鑑識分析技術與風險模型，發掘潛藏在企業內部的未知威脅，提前預防網路攻擊。以此平台進行定期的資訊安全檢查，更可幫助企業更好地保護端點。

更多介紹，請見：[ThreatSonar 威脅鑑識分析平台](https://teamt5.org/tw/products/threatsonar/?utm_source=blog&utm_medium=website)

## TeamT5 杜浦數位安全參展 InnoVEX 資訊
- 日期：2025 / 5 / 20 ～23
- 時間：9:30 ~ 17:30
- 地點：台北南港展覽館二館4樓
- 攤位編號：S1025a

![](https://uploads.teamt5.org/upload/original/pic_teamt5-will-showcase-solutions-at-2025-innovex.png)

TeamT5 杜浦數位安全即將於 2025 InnoVEX (COMPUTEX) 展出

Events

>[Press Release on PR Newswire](https://www.prnewswire.com/apac/news-releases/teamt5-warns-of-global-risks-posed-by-ivanti-vulnerability-302437073.html)

![](https://uploads.teamt5.org/upload/original/pic_teamt5-warns-of-global-risks-posed-by-ivanti-vulnerability.jpg)

TAIPEI, April 24, 2025 /PRNewswire/Asia Pacific threat intelligence leading brand TeamT5 detected that the China-nexus APT group exploited the critical vulnerability in Ivanti Connect Secure VPN appliances to infiltrate multiple entities around the globe. The victims include nearly 20 different industries across 12 countries. TeamT5 believes that the actor still maintained control over the victim's network at the time of analysis. We urge enterprises and organizations to take a comprehensive investigation.

##Ivanti High-Risk Vulnerability Exposes Systems to Potential Takeover by Attackers
TeamT5’s analysis assessed with high confidence that the actor was exploiting the vulnerabilities of Ivanti Connect Secure VPN appliances to launch attacks around the globe. The actor possibly exploited [CVE-2025-0282](https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283?language=en_US) or [CVE-2025-22457](https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457?language=en_US) to conduct initial access.

Both CVE-2025-0282 and CVE-2025-22457 are stack buffer overflow vulnerabilities in Ivanti Connect Secure VPN with a CVSS score of 9.0. Successful exploitation allows the threat actor to achieve remote code execution, leading to intrusion of the internal network and malware implantation.

In the attack, the actor deployed a shared weapon among Chinese threat groups, SPAWNCHIMERA. SPAWNCHIMERA is developed specifically for Ivanti Connect Secure VPN and has all the functionalities of the notorious SPAWN family, including SPAWNANT (installer), SPAWNMOLE (socks5 tunnler), SPAWNSNAIL (SSH backdoor), and SPAWNSLOTH (log wiper).

Moreover, TeamT5’s analysis suggests that other threat actors might also obtain the vulnerability information and start campaigns targeting Ivanti VPN appliances. We have observed massive exploitation attempts against Ivanti VPN appliances since April. Although most exploitation attempts failed, many Ivanti VPN appliances became paralyzed and unstable. 

##Widespread Impact Across Countries and Industries Calls for Urgent System Review
TeamT5 points out that the victim countries include Austria, Australia, France, Spain, Japan, South Korea, Netherlands, Singapore, Taiwan, the United Arab Emirates, the United Kingdom, and the United States. The targeted industries include Automotive, Chemical, Conglomerate, Construction, Information Security, Education, Electronics, Financial Institution, Gambling, Government, Intergovernmental Organizations (IGOs), Information Technology, Law Firm, Manufacturing, Materials, Media, Non-Governmental Organizations (NGOs), Research Institute, and Telecommunication.

TeamT5 strongly recommends that affected organizations conduct a thorough incident investigation. Given the versatile TTPs of the actor, such as multi-layers of C2 infrastructure, evasion of monitor mechanism, and the usage of log wiper, without additional technical support, it would be a challenge to detect the actor’s malicious traces inside the network. 


##About TeamT5
TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. TeamT5 is frequently invited to share insights at top cybersecurity conferences. Our threat intelligence research expertise and solutions are recognized as the 2023-2024 Company of the Year Award in Taiwanese Threat Intelligence by Frost & Sullivan.
 
Based on our research in malware & Advanced Persistent Threat (APT), we provide cyber threat intelligence reports and anti-ransomware solutions to clients in the USA and Asia Pacific region. Clients include government agencies, financial business, and high tech enterprises.
 
 
 
Website: https://teamt5.org/en/ 
Contact: pr@teamt5.org

TeamT5 Warns of Global Risks Posed by Ivanti Vulnerability

![](https://uploads.teamt5.org/upload/original/pic_teamt5-warns-of-global-risks-posed-by-ivanti-vulnerability.jpg)

威脅情資領導品牌 TeamT5 杜浦數位安全研究指出，與中國有關聯之進階持續性威脅（APT）攻擊者，利用 Ivanti Connect Secure VPN 高風險漏洞發動攻擊，受害單位橫跨全世界 12 個國家，近 20 個不同產業。TeamT5 認為攻擊者仍持續控制受害者的網路，呼籲企業與組織完整盤點系統狀況。

##Ivanti 高風險漏洞使系統恐受攻擊者控制
TeamT5 初步判定攻擊者利用 Ivanti Connect Secure VPN 相關的高風險漏洞，展開攻擊；推測可能是利用 [CVE-2025-0282](https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283?language=en_US) 或 [CVE-2025-22457](https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457?language=en_US) 取得初步存取權限。

CVE-2025-0282 和 CVE-2025-22457 皆是 Ivanti Connect Secure VPN 的堆疊緩衝區溢位（stack buffer overflow）漏洞，CVSS 分數高達 9.0（滿分為 10 分）。漏洞成功利用後，攻擊者便可實現遠端程式碼執行，進而入侵內部網路和部署惡意程式。

以其中一例攻擊來說，攻擊者部署的是中國威脅族群的共用惡意程式 SPAWNCHIMERA。SPAWNCHIMERA 是專為 Ivanti Connect Secure VPN 所開發，具備 SPAWN 家族惡意程式的所有功能，包括 SPAWNANT （安裝程式）、SPAWNMOLE（socks5 網路隧道程式）、SPAWNSNAIL（SSH 後門程式）和 SPAWNSLOTH（記錄抹除程式）。

此外，TeamT5 分析研判，其他攻擊者可能也取得漏洞相關資訊，並著手展開針對 Ivanti VPN 設備的攻擊行動。自 4 月以來，我們發現針對 Ivanti VPN 設備的大規模漏洞攻擊嘗試。雖然絕大多數的漏洞攻擊嘗試都以失敗告終，但卻也造成這些 Ivanti VPN 設備被癱瘓且變得不穩定。

##受害國家與產業別眾多 宜完整盤點系統狀況
TeamT5 指出受害國家包括奧地利、澳洲、法國、西班牙、日本、南韓、荷蘭、新加坡、台灣、英國、美國、阿拉伯聯合大公國。而受害產業則包括汽車、化學、電信、營造、資安、教育、電子、金融、博弈、政府、法律、製造、媒體、企業集團、跨政府組織、非政府組織、資訊科技、研究機構。

TeamT5 建議受影響單位應即刻展開完整的事件調查。基於攻擊者手法的多變性，如多層次 C2 基礎架構、監控機制迴避與使用記錄抹除程式，若缺乏額外的技術協助，恐不易深入調查內部網路的攻擊者足跡。若需任何進一步的技術協助，可直接聯繫 TeamT5。


##關於 TeamT5 杜浦數位安全
TeamT5 專精網路威脅研究，並提供端點偵測與回應（EDR）解決方案，協助美日臺大型企業有效保護商業機密文件，讓營運不受網路攻擊影響。TeamT5 也獲得日本三大巨頭投資，包含日本最大創投 JAFCO 集富集團、日本最大跨國企業且在全球皆有商業投資的 ITOCHU 伊藤忠商事，以及日本最大資安解决方案提供商 MACNICA。

團隊具備超過 20 年的惡意程式與進階持續性威脅（APT）的研究經驗，運用地緣和語言優勢，有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。

 

官網：https://teamt5.org/tw/ 
新聞聯絡窗口：pr@teamt5.org

全球面臨「Ivanti 漏洞」風險 TeamT5 呼籲全面清查

News

TeamT5 與 Threatray 宣布戰略研究合作。兩者皆為其領域的佼佼者——亞太威脅情資領導品牌 TeamT5 以其獨到的研究能力為全球政府部門、高科技企業和銀行提供亞太威脅情資；瑞士技術領導者 Threatray 專注惡意軟體識別、歸因和情資。透過本次合作將使企業與組織更精確地追蹤威脅族群和其活動，進而提升威脅情資品質。

藉由合作，Threatray 將運用 TeamT5 的優質威脅情資，增強其惡意軟體威脅搜尋和分析引擎。同時，TeamT5 將取得 Threatray 獨特的 Binary 情資分析能力，提升自身研究和情資收集能力；TeamT5 也將與 Threatray 分享其網路間諜研究成果，同時利用 Threatray 的 Binary 情資平台增強其分析能力。

TeamT5 執行長蔡松廷表示：「對於 TeamT5 威脅情資團隊來說，此次合作旨在提高我們的研究能力、加速我們的分析流程並拓寬我們的研究視野。」

Threatray 執行長 Endre Bangerter 表示：「此次合作結合了獨特的數據和 Binary 分析功能，可提供無與倫比的網路威脅洞察。未來，我們將共同為威脅情資樹立新標準。」


##關於杜浦數位安全 TeamT5
TeamT5 為亞太威脅情資領導品牌，獲國際顧問公司 Frost & Sullivan 於 2023~2024 連續兩年肯定為臺灣最佳威脅情資公司。

我們立足臺灣，並善用地緣與文化優勢，透過以威脅情資為基底的產品，幫助企業和組織加強其資訊安全防禦。這使得其分析師能夠預見潛在的資安威脅和事件，並為決策者提供行動指引，以做出精確決策並降低風險。

了解更多：[https://teamt5.org/tw/](https://teamt5.org/tw/?utm_source=blog&utm_medium=website)

##關於 Threatray
Threatray 為深度 Binary 分析領域的領導者，挖掘出 Binary 的價值，以實現新一代惡意軟體偵測和 Binary 情資的可能性。 Threatray 的核心技術包括用於 Binary 分析的人工智慧/機器學習（AI/ML） 模型和高度可擴展的惡意軟體程式碼搜尋引擎，能夠在幾秒鐘內將未知樣本與豐富資料庫比對，該資料庫快速增長、Binary 已超過 1 億。這項先進的技術為 Threatray 的 Binary 情資平台奠立深厚基礎，且該平台專門為惡意軟體研究人員和情資分析師提供精確歸因、快速分類和情資產出之功能。

了解更多：https://www.threatray.com/

 
 

![](https://uploads.teamt5.org/upload/original/pic_uniting-for-discovery-teamt5-and-threatray-announce-joint-research-collaboration-to-unlock-new-frontiers.jpg)

TeamT5 與 Threatray 宣布戰略研究合作，提升情資威脅研究與網路防禦能量

TeamT5, a leading brand in delivering Asia Pacific intelligence for government units, high technology enterprises, and banks across the globe and Threatray, a Swiss technology leader in malware identification, attribution and intelligence, announced today that they are entering into a joint research collaboration.

The collaboration between the two companies enables more precise tracking of threat actors and campaigns, leading to improved threat landscape reporting. Through TeamT5’s high quality data, Threatray will enhance the malware threat search and analytics engine. In turn, TeamT5 will gain access to Threatray’s unique binary intelligence capabilities, strengthening the research and intelligence-gathering capabilities.

As part of this joint research collaboration, TeamT5 will share its cyber espionage research findings with Threatray, while utilizing Threatray’s binary intelligence platform to enhance its analysis capabilities.

“For the TeamT5 CTI team, this partnership aims to boost our research capabilities, accelerate our analytical processes, and broaden our research visibility," said Sung-ting Tsai, CEO of TeamT5.

"This partnership combines unique data and binary analysis capabilities to deliver unparalleled insights into cyber threats. Together, we're setting a new standard in threat intelligence," said Endre Bangerter, Threatray CEO.

##About TeamT5
TeamT5 is a leading brand in delivering Asia Pacific intelligence. TeamT5 receives international recognition as 2023-2024 Taiwan's Best Threat Intelligence Company by Frost & Sullivan.

We are established in Taiwan and harness our geographical & cultural strengths to assist enterprises and organizations in fortifying their cybersecurity defenses through our intelligence-focused offerings. This allows analysts to foresee potential threats & incidents and deliver action items for decision-makers to make accurate decisions and mitigate risks. 

Learn more at [https://teamt5.org/en/](https://teamt5.org/en/?utm_source=blog&utm_medium=website).

##About Threatray
Threatray is a leader in deep binary code analysis, unlocking the value of binary code for a new generation of malware detection and binary intelligence capabilities. Threatray's core technology consists of AI/ML models for binary code analysis and a highly scalable search engine for malware code, capable of matching unknown samples against a rapidly growing database of over 100 million binaries in seconds. This advanced technology powers our binary intelligence platform, specifically designed to support malware researchers and intelligence analysts with precise attribution, rapid classification, and intelligence generation capabilities. 

Learn more at https://www.threatray.com/

 
 

![](https://uploads.teamt5.org/upload/original/pic_uniting-for-discovery-teamt5-and-threatray-announce-joint-research-collaboration-to-unlock-new-frontiers.jpg)

Uniting for Discovery: TeamT5 and Threatray Announce Joint Research Collaboration to Unlock New Frontiers

面對近日台灣多起勒索軟體攻擊事件，TeamT5 一直以來偕同客戶，站在資安防護的第一線。藉由 TeamT5 MDR 威脅偵測應變代管服務與 TeamT5 自主開發的 ThreatSonar Anti-Ransomware 端點偵測系統，持續 7 * 24 全時監控威脅，協助各企業與組織對抗加密勒索與 APT 攻擊，在第一時間通報資安團隊偵測結果，並提出建議措施、快速應變，避免後續發生重大資安事件。

不僅如此，透過 TeamT5 的深暗網監控服務，能及早為企業與組織檢查機敏資料是否外洩、是否遭到非法利用，保護自身資訊安全。

為協助企業與組織清查潛在威脅，並有效偵測攻擊行為，TeamT5 在 2025 資安大會期間，於展會現場提供以下免費申請： 
(1) [MDR 威脅偵測應變代管服務](https://teamt5.org/tw/service/mdr/?utm_source=news&utm_medium=website)：為期 3 個月，共 100 個端點授權。 
(2) 一次性[深暗網外洩帳號密碼獵尋服務](https://teamt5.org/tw/products/deep-dark-web-intelligence/?utm_source=news&utm_medium=website)：1 個域名。 


## 申請期限
2025/04/15 至 2025/04/17

## 申請方式
請填寫 [TeamT5 資安大會預約諮詢申請表單](https://pse.is/7du6xb)，依預約時段至 TeamT5 現場攤位，將有專人提供詳細方案說明。

![](https://uploads.teamt5.org/upload/original/pic_2025-cybersec-teamt5-special-offer.png)

情資驅動資安防禦

產品

Designed for APT & Ransomware Protection

An Engine to Hunt down Intruders

A Portal to See Through the Chaos

量身打造企業防駭計畫

部落格