Network intelligence firm Tektronix buys Arbor

One or more threat actors are currently exploiting CVE-2025-0282 for remote takeover attacks on targeted networks.

Intrusions involving the now-patched flaw, which could be leveraged to facilitate remote code execution, have stemmed from seven Singapore- and Hong Kong-based IP addresses, according to an analysis from GreyNoise.

Attacks exploiting the vulnerability not only deployed the SPAWN malware previously launched by Chinese state-backed intrusions involving Ivanti Connect Secure bugs but also the novel PHASEJAM and DRYHOOK payloads in an attempt to compromise databases with credentials, API keys, VPN sessions, and certificates, a report from Mandiant researchers revealed.