New blog from TeamT5 warns a China-nexus APT is exploiting a vulnerability in #Ivanti Connect Secure VPN appliances to target victims in EMEA and the US. Today Shadowserver's CVE-2025-22457 tracker shows 4,098 unpatched instances remain, mostly in Asia and the US.
pse.is/7esf4n
pse.is/7esf4n
China-nexus APT exploits Ivanti Connect Secure VPN vulnerability to infiltrate multiple entities - TeamT5
In late March, TeamT5 detected that the China-nexus APT group exploited the critical vulnerability in Ivanti Connect Secure VPN appliances to infiltrate multiple entities around the globe. The victims...
pse.is
April 14, 2025 at 12:35 PM
New blog from TeamT5 warns a China-nexus APT is exploiting a vulnerability in #Ivanti Connect Secure VPN appliances to target victims in EMEA and the US. Today Shadowserver's CVE-2025-22457 tracker shows 4,098 unpatched instances remain, mostly in Asia and the US.
pse.is/7esf4n
pse.is/7esf4n
A new ransomware operation named CrazyHunter is targeting organizations in Taiwanese critical sectors. The group has ransomed three hospitals, a university, and a power grid operator since the start of the month.
teamt5.org/en/posts/how...
teamt5.org/en/posts/how...
March 13, 2025 at 1:10 PM
A new ransomware operation named CrazyHunter is targeting organizations in Taiwanese critical sectors. The group has ransomed three hospitals, a university, and a power grid operator since the start of the month.
teamt5.org/en/posts/how...
teamt5.org/en/posts/how...
"Know Thy Network, Because They Already Do: A Case Study of SLIME27's Campaign against Telecoms"
Silvia Yeh, Cyber Threat Intelligence Analyst at TeamT5
Rax Chuang, Cyber Threat Researcher at TeamT5
12/15
Silvia Yeh, Cyber Threat Intelligence Analyst at TeamT5
Rax Chuang, Cyber Threat Researcher at TeamT5
12/15
March 10, 2026 at 5:23 PM
"Know Thy Network, Because They Already Do: A Case Study of SLIME27's Campaign against Telecoms"
Silvia Yeh, Cyber Threat Intelligence Analyst at TeamT5
Rax Chuang, Cyber Threat Researcher at TeamT5
12/15
Silvia Yeh, Cyber Threat Intelligence Analyst at TeamT5
Rax Chuang, Cyber Threat Researcher at TeamT5
12/15
Really excited to present at #LABScon25 on ChamelGang‘s most recent campaign targeting the Taliban, a collaborative research project with @milenkowski.bsky.social (SentinelLABS) and @azaka.fun (TeamT5)! www.labscon.io/speakers/jul...
September 16, 2025 at 1:50 PM
Really excited to present at #LABScon25 on ChamelGang‘s most recent campaign targeting the Taliban, a collaborative research project with @milenkowski.bsky.social (SentinelLABS) and @azaka.fun (TeamT5)! www.labscon.io/speakers/jul...
🚀LABScon kicks off tomorrow!
I am excited to be presenting on the APT group CamoFei, a joint research project with @julianferdinand.bsky.social (Recorded Future) and @azaka.fun (TeamT5). [1/3]
I am excited to be presenting on the APT group CamoFei, a joint research project with @julianferdinand.bsky.social (Recorded Future) and @azaka.fun (TeamT5). [1/3]
September 16, 2025 at 11:37 AM
🚀LABScon kicks off tomorrow!
I am excited to be presenting on the APT group CamoFei, a joint research project with @julianferdinand.bsky.social (Recorded Future) and @azaka.fun (TeamT5). [1/3]
I am excited to be presenting on the APT group CamoFei, a joint research project with @julianferdinand.bsky.social (Recorded Future) and @azaka.fun (TeamT5). [1/3]
6/ Sincerely grateful to the all-star team of experts who shared their insights and feedback: Scott Henderson (Google Mandiant), Adam Kozy (SinaCyber), @meidanowski.bsky.social (@nattothoughts.bsky.social), @thegrugq.bsky.social, @Chris St.Myers (SentinelOne), & Charles Li and Zha0 (TeamT5)
July 21, 2025 at 8:12 AM
6/ Sincerely grateful to the all-star team of experts who shared their insights and feedback: Scott Henderson (Google Mandiant), Adam Kozy (SinaCyber), @meidanowski.bsky.social (@nattothoughts.bsky.social), @thegrugq.bsky.social, @Chris St.Myers (SentinelOne), & Charles Li and Zha0 (TeamT5)
U.S. CISA adds Google Chromium CSS, Microsoft Windows, TeamT5 ThreatSonar Anti-Ransomware, and Zimbra flaws to its Known Exploited Vulnerabilities catalog
U.S. CISA adds Google Chromium CSS, Microsoft Windows, TeamT5 ThreatSonar Anti-Ransomware, and Zimbra flaws to its Known Exploited Vulnerabilities catalog
U.S. CISA adds Google Chromium CSS, Microsoft Windows, TeamT5 ThreatSonar, and Zimbra flaws to its Known Exploited Vulnerabilities catalog.
securityaffairs.com
February 18, 2026 at 11:50 AM
U.S. CISA adds Google Chromium CSS, Microsoft Windows, TeamT5 ThreatSonar Anti-Ransomware, and Zimbra flaws to its Known Exploited Vulnerabilities catalog
#ICYMI
🇨🇳 🇷🇺 Chinese state-sponsored groups including Mustang Panda and Tonto Team have been targeting Russian aerospace and defense firms looking for intelligence on Moscow's military capabilities, researchers at the Taiwanese cybersecurity firm TeamT5 told POLITICO
www.politico.eu/article/chin...
🇨🇳 🇷🇺 Chinese state-sponsored groups including Mustang Panda and Tonto Team have been targeting Russian aerospace and defense firms looking for intelligence on Moscow's military capabilities, researchers at the Taiwanese cybersecurity firm TeamT5 told POLITICO
www.politico.eu/article/chin...
China’s cyber spies are targeting Russia’s aerospace and defense firms
State-backed hackers seek intel on nuclear weapons and military capabilities, researchers say.
www.politico.eu
January 23, 2025 at 3:47 PM
#ICYMI
🇨🇳 🇷🇺 Chinese state-sponsored groups including Mustang Panda and Tonto Team have been targeting Russian aerospace and defense firms looking for intelligence on Moscow's military capabilities, researchers at the Taiwanese cybersecurity firm TeamT5 told POLITICO
www.politico.eu/article/chin...
🇨🇳 🇷🇺 Chinese state-sponsored groups including Mustang Panda and Tonto Team have been targeting Russian aerospace and defense firms looking for intelligence on Moscow's military capabilities, researchers at the Taiwanese cybersecurity firm TeamT5 told POLITICO
www.politico.eu/article/chin...
Bloomberg: Chinese ‘State-affiliated cyber groups more than doubled the amount of attacks they carried out since they began delegating mundane tasks to AI and using it to develop advanced malicious software, according to TeamT5, a Taiwanese research firm.’
China’s Hackers Use DeepSeek for Attacks, Researchers Say
Chinese hackers are ramping up attacks after integrating DeepSeek and other open-source artificial intelligence models into their operations, highlighting attackers’ ability to leverage basic AI tools...
www.bloomberg.com
August 25, 2026 at 7:50 AM
Bloomberg: Chinese ‘State-affiliated cyber groups more than doubled the amount of attacks they carried out since they began delegating mundane tasks to AI and using it to develop advanced malicious software, according to TeamT5, a Taiwanese research firm.’
Chinese state-linked hacking groups have more than doubled their attack output after wiring low-cost artificial intelligence models into their operations, according to Taiwanese threat intelligence firm TeamT5.
August 26, 2026 at 6:27 AM
Chinese state-linked hacking groups have more than doubled their attack output after wiring low-cost artificial intelligence models into their operations, according to Taiwanese threat intelligence firm TeamT5.
TeamT5 reported that the China-nexus APT exploited Ivanti Connect Secure VPN vulnerabilities to infiltrate nearly 20 industries across 12 countries, maintaining control over victim networks during analysis. #CyberSecurity #APT teamt5.org/en/posts/chi...
China-nexus APT exploits Ivanti Connect Secure VPN vulnerability to infiltrate multiple entities - TeamT5
In late March, TeamT5 detected that the China-nexus APT group exploited the critical vulnerability in Ivanti Connect Secure VPN appliances to infiltrate multiple entities around the globe. The victims...
teamt5.org
April 14, 2025 at 4:52 PM
TeamT5 reported that the China-nexus APT exploited Ivanti Connect Secure VPN vulnerabilities to infiltrate nearly 20 industries across 12 countries, maintaining control over victim networks during analysis. #CyberSecurity #APT teamt5.org/en/posts/chi...
中国政府支持的黑客组织自俄乌战争爆发以来，持续渗透俄罗斯政府与军工系统，目标是窃取军事机密与实战经验，尤其关注核潜艇、作战战术与西方武器表现。尽管中俄高层不断宣示“友谊无上限”，这些入侵行动显示出中国将俄罗斯视为可利用的情报目标。2023年，台湾网络安全公司TeamT5揭露“中国黑客冒充俄罗斯工程公司邮箱”，试图获取潜艇技术。俄国安局（FSB）内部机密文件，称中方为“敌方”，意图获取俄军乌克兰战场经验。此事揭示中俄“战略协作”背后的高度不信任，以及中国对战争情报的现实渴求，凸显北京在对外政策上“表友实敌”的务实姿态。
China Unleashes Hackers Against Its Friend Russia, Seeking War Secrets
www.nytimes.com
June 21, 2025 at 9:15 AM
中国政府支持的黑客组织自俄乌战争爆发以来，持续渗透俄罗斯政府与军工系统，目标是窃取军事机密与实战经验，尤其关注核潜艇、作战战术与西方武器表现。尽管中俄高层不断宣示“友谊无上限”，这些入侵行动显示出中国将俄罗斯视为可利用的情报目标。2023年，台湾网络安全公司TeamT5揭露“中国黑客冒充俄罗斯工程公司邮箱”，试图获取潜艇技术。俄国安局（FSB）内部机密文件，称中方为“敌方”，意图获取俄军乌克兰战场经验。此事揭示中俄“战略协作”背后的高度不信任，以及中国对战争情报的现实渴求，凸显北京在对外政策上“表友实敌”的务实姿态。
Event: RSA Conference 2026
Expo date: March 24-26, 2026
Booth: S-1561
Location: Moscone Center at San Francisco, USA
teamt5.org/en/posts/tea...
Expo date: March 24-26, 2026
Booth: S-1561
Location: Moscone Center at San Francisco, USA
teamt5.org/en/posts/tea...
We’re Exhibiting at RSA Conference 2026 - TeamT5
We are pleased to announce that we will be exhibiting at **RSA Conference 2026**, one of the world’s leading cybersecurity events, taking place in San Francisco.
This year, we will join the **Taiwan P...
teamt5.org
March 2, 2026 at 9:08 AM
Event: RSA Conference 2026
Expo date: March 24-26, 2026
Booth: S-1561
Location: Moscone Center at San Francisco, USA
teamt5.org/en/posts/tea...
Expo date: March 24-26, 2026
Booth: S-1561
Location: Moscone Center at San Francisco, USA
teamt5.org/en/posts/tea...
Critical Flaw in TeamT5 ThreatSonar Anti-Ransomware Confirmed Exploited by Chinese APTs, Added to CISA KEV
AllSafeUs Research Labs has been closely monitoring a critical development in the cybersecurity landscape: a significant vulnerability within the TeamT5 ThreatSonar Anti-Ransomware solution.…
AllSafeUs Research Labs has been closely monitoring a critical development in the cybersecurity landscape: a significant vulnerability within the TeamT5 ThreatSonar Anti-Ransomware solution.…
Critical Flaw in TeamT5 ThreatSonar Anti-Ransomware Confirmed Exploited by Chinese APTs, Added to CISA KEV
AllSafeUs Research Labs has been closely monitoring a critical development in the cybersecurity landscape: a significant vulnerability within the TeamT5 ThreatSonar Anti-Ransomware solution. This flaw, recently highlighted by a Taiwanese security firm, has been confirmed as actively exploited by sophisticated Chinese Advanced Persistent Threat (APT) groups. The urgency of this situation is further underscored by its immediate inclusion in the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog, mandating rapid remediation by U.S.
allsafeus.com
February 24, 2026 at 12:08 PM
Critical Flaw in TeamT5 ThreatSonar Anti-Ransomware Confirmed Exploited by Chinese APTs, Added to CISA KEV
AllSafeUs Research Labs has been closely monitoring a critical development in the cybersecurity landscape: a significant vulnerability within the TeamT5 ThreatSonar Anti-Ransomware solution.…
AllSafeUs Research Labs has been closely monitoring a critical development in the cybersecurity landscape: a significant vulnerability within the TeamT5 ThreatSonar Anti-Ransomware solution.…
CISA Alert: Immediate Action Required for Actively Exploited TeamT5 ThreatSonar Anti-Ransomware Vulnerability
AllSafeUs Research Labs is issuing an urgent security advisory following a recent alert from the Cybersecurity and Infrastructure Security Agency (CISA). CISA has added a critical…
AllSafeUs Research Labs is issuing an urgent security advisory following a recent alert from the Cybersecurity and Infrastructure Security Agency (CISA). CISA has added a critical…
CISA Alert: Immediate Action Required for Actively Exploited TeamT5 ThreatSonar Anti-Ransomware Vulnerability
AllSafeUs Research Labs is issuing an urgent security advisory following a recent alert from the Cybersecurity and Infrastructure Security Agency (CISA). CISA has added a critical vulnerability affecting TeamT5's ThreatSonar Anti-Ransomware product to its Known Exploited Vulnerabilities (KEV) catalog. This designation signifies that the vulnerability is not merely theoretical but is actively being exploited by threat actors in real-world attacks. Organizations leveraging ThreatSonar Anti-Ransomware are strongly advised to take immediate mitigation steps.
allsafeus.com
February 18, 2026 at 11:08 AM
CISA Alert: Immediate Action Required for Actively Exploited TeamT5 ThreatSonar Anti-Ransomware Vulnerability
AllSafeUs Research Labs is issuing an urgent security advisory following a recent alert from the Cybersecurity and Infrastructure Security Agency (CISA). CISA has added a critical…
AllSafeUs Research Labs is issuing an urgent security advisory following a recent alert from the Cybersecurity and Infrastructure Security Agency (CISA). CISA has added a critical…
Lots of scaled up cyberattacks against Taiwan using AI (h/t the Metacurity Newsletter)
Chinese Hackers Escalate Cyberattacks Using Open-Source AI
Chinese Hackers Escalate Cyberattacks Using Open-Source AI Chinese hackers use DeepSeek AI to escalate cyberattacks, TeamT5 finds
www.chosun.com
August 25, 2026 at 3:44 PM
Lots of scaled up cyberattacks against Taiwan using AI (h/t the Metacurity Newsletter)
TeamT5: hackers vinculats a la Xina han duplicat el volum d'atacs des que incorporen DeepSeek. Motiu? "És potent i té molt poques barreres de ciberseguretat", segons Charles Li. Grups com Grimfengxi, Huapi i Teleboyi l'u ...
[^BgTA^] :verified: :opensuse: (@raul@mastodon.in4matics.cat)
TeamT5: hackers vinculats a la Xina han duplicat el volum d'atacs des que incorporen DeepSeek. Motiu? "És potent i té molt poques barreres de ciberseguretat", segons Charles Li. Grups com Grimfengxi, Huapi i Teleboyi l'usen per generar exploits, atacar email systems i mapejar xarxes senceres. La IA barata canvia l'escala de l'atac, no la sofisticació.
https://share.google/aimode/Ckz1EXsSsWycPUPVw
#DeepSeek #Ciberseguretat #Ciberatacs
mastodon.in4matics.cat
August 26, 2026 at 6:30 AM
TeamT5: hackers vinculats a la Xina han duplicat el volum d'atacs des que incorporen DeepSeek. Motiu? "És potent i té molt poques barreres de ciberseguretat", segons Charles Li. Grups com Grimfengxi, Huapi i Teleboyi l'u ...
China’s cyber spies are targeting Russia’s aerospace and defence firms – POLITICO Europe: ‘researchers at the Taiwanese cybersecurity firm TeamT5 told POLITICO.’
China’s cyber spies are targeting Russia’s aerospace and defense firms
State-backed hackers seek intel on nuclear weapons and military capabilities, researchers say.
www.politico.eu
January 24, 2025 at 3:01 AM
China’s cyber spies are targeting Russia’s aerospace and defence firms – POLITICO Europe: ‘researchers at the Taiwanese cybersecurity firm TeamT5 told POLITICO.’
Great report from SentinelOne, Recorded Future and TeamT5 about China's use of ransomware to provide cover for espionage campaigns
Confirms some of what I reported about the attack on the government of Palau earlier this year
therecord.media/chamelgang-c...
Confirms some of what I reported about the attack on the government of Palau earlier this year
therecord.media/chamelgang-c...
Suspected Chinese gov’t hackers used ransomware as cover in attacks on Brazil presidency, Indian health org
Hackers believed to be working for the Chinese government are increasingly deploying ransomware in an effort to cause disruption and provide cover for espionage operations — most notably in attacks on...
therecord.media
June 27, 2024 at 10:04 PM
Great report from SentinelOne, Recorded Future and TeamT5 about China's use of ransomware to provide cover for espionage campaigns
Confirms some of what I reported about the attack on the government of Palau earlier this year
therecord.media/chamelgang-c...
Confirms some of what I reported about the attack on the government of Palau earlier this year
therecord.media/chamelgang-c...
Wie chinesische Hacker mit einer Word-Datei Russland ausspionieren wollten – Der Spiegel: „Den Anhang haben Cyberexperten der taiwanischen Sicherheitsfirma TeamT5 entdeckt und mit dem SPIEGEL geteilt.“
(S+) Wie chinesische Hacker mit einer Word-Datei Russland ausspionieren wollten
Peking ist Putins wichtigster Partner, doch Misstrauen bleibt: China will Moskaus Kriegswissen abschöpfen. Vor allem auf die russische Luftfahrt- und Drohnenexpertise haben es Spione abgesehen.
www.spiegel.de
August 31, 2025 at 10:16 AM
Wie chinesische Hacker mit einer Word-Datei Russland ausspionieren wollten – Der Spiegel: „Den Anhang haben Cyberexperten der taiwanischen Sicherheitsfirma TeamT5 entdeckt und mit dem SPIEGEL geteilt.“
www.chosun.com/english/indu...
I knew this day would go back on 2008.
I have a U.S. Patent on any advanced threat management system to stop cyber attacks including AI based.
Unfortunately due to funding requirements we were not able to fund it.
I knew this day would go back on 2008.
I have a U.S. Patent on any advanced threat management system to stop cyber attacks including AI based.
Unfortunately due to funding requirements we were not able to fund it.
Chinese Hackers Escalate Cyberattacks Using Open-Source AI
Chinese Hackers Escalate Cyberattacks Using Open-Source AI Chinese hackers use DeepSeek AI to escalate cyberattacks, TeamT5 finds
www.chosun.com
August 25, 2026 at 3:51 PM
www.chosun.com/english/indu...
I knew this day would go back on 2008.
I have a U.S. Patent on any advanced threat management system to stop cyber attacks including AI based.
Unfortunately due to funding requirements we were not able to fund it.
I knew this day would go back on 2008.
I have a U.S. Patent on any advanced threat management system to stop cyber attacks including AI based.
Unfortunately due to funding requirements we were not able to fund it.