A China-linked advanced persistent threat (APT) group has exploited critical vulnerabilities in Ivanti Connect Secure VPN appliances to infiltrate organizations across 12 countries and 20 industries, cybersecurity firm TeamT5 revealed in a report shared with Cyber Security News. The campaign, active since late March 2025, leverages the CVE-2025-0282 and CVE-2025-22457 vulnerabilities both stack-based buffer overflow flaws with maximum CVSS scores of 9.0—to deploy the SPAWNCHIMERA malware suite and establish persistent network access. The attacks impacted entities in Austria, Australia, France, Spain, Japan, South Korea, the Netherlands, Singapore, Taiwan, the UAE, the UK, and the U.S. Targeted industries span high-value sectors such as government agencies, financial institutions, telecommunications, law firms, and intergovernmental organizations, TeamT5 said.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 14 Apr 2025 08:55:12 +0000