Hackers Exploit Ivanti and Fortinet VPN Vulnerabilities in Attacks on Japanese Companies

Cyber espionage campaigns against Japanese companies have increased in fiscal year 2024, which runs from April 2024 to March 2025, according to a thorough analysis published by Macnica’s Security Research Center.

The main objective of these campaigns is to exfiltrate sensitive data, including manufacturing blueprints, policy-related documents, and personal information.

Since initiating monitoring in 2014, the center has observed a marked escalation in activities attributed to North Korean threat actors, who have ramped up operations compared to previous years.

Surge in North Korean Cyber Espionage

Notably, these groups have aggressively targeted software developers through malware like BeaverTail and InvisibleFerret, which facilitate initial compromise and persistence.

Additionally, deployments of the RokRAT backdoor have been prevalent, enabling adversaries to siphon stolen data to legitimate cloud storage services, thereby blending malicious traffic with benign operations to evade detection.

This uptick aligns with broader financial motivations, evolving from historical exploits like the 2016 SWIFT network attacks where North Korean actors orchestrated massive illegal remittances from financial institutions to contemporary schemes zeroing in on cryptocurrency ecosystems.

Recent incidents involve infiltrating developer environments to access exchange wallets, resulting in unauthorized cryptocurrency thefts.

Such tactics underscore a shift toward high-value, low-visibility operations that leverage social engineering and supply chain vulnerabilities.

The report highlights a diverse array of intrusion vectors, with spear phishing remaining the dominant initial access technique, often masquerading as legitimate communications to deliver payloads.

Intrusions via externally exposed assets, such as vulnerable web servers or misconfigured APIs, have also surged, providing attackers with footholds for lateral movement.

Beyond email-based phishing, there’s a notable rise in social engineering exploits through platforms like LinkedIn, where tailored messages lure targets into executing malicious code.

USB propagation continues to pose risks, as seen in campaigns by the Mustang Panda group, which disseminates the PlugX remote access trojan (RAT) via infected removable media, enabling command-and-control (C2) over compromised endpoints.

Similarly, the TELEBOYi cluster has sustained PlugX deployments since the prior year, often integrating evasion techniques like WinDivert, a user-mode packet interception library, to disrupt communications with endpoint detection and response (EDR) servers and thwart real-time monitoring.

Exploitation of Zero-Day Vulnerabilities

A critical finding involves zero-day exploits against Ivanti’s VPN appliances, observed in early 2025, mirroring patterns from the previous year and allowing unauthenticated remote code execution (RCE) to bypass perimeter defenses.

Parallel campaigns have targeted Fortinet VPN devices, exploiting similar vulnerabilities to gain initial access, particularly at overseas manufacturing outposts of Japanese firms.

These intrusions frequently progress to the reconnaissance phase of living-off-the-land (LotL) attacks, where adversaries abuse native system tools like PowerShell or WMI for enumeration and data staging without introducing custom malware, complicating forensic analysis.

In March 2025, a spike in spear phishing attempts aimed at deploying the ANEL backdoor via MirrorFace infrastructure was detected, further illustrating the persistence of advanced persistent threat (APT) groups in probing Japanese networks.

Industry-wise, the attacks span multiple sectors, with manufacturing, finance, and technology bearing the brunt, as visualized in Macnica’s breakdown of targeted verticals.

While some infection routes remain unidentified potentially indicating sophisticated zero-click exploits or insider threats the report emphasizes the need for enhanced threat hunting, multi-factor authentication on exposed services, and regular patching of edge devices like VPN gateways.

As North Korean and affiliated actors refine their toolsets, Japanese organizations face an evolving threat landscape that demands proactive defenses against both opportunistic and targeted cyber operations.

This analysis serves as a call to action, urging bolstered awareness and resilience measures to mitigate the theft of intellectual property and critical data in an increasingly contested digital domain.

Stay Updated on Daily Cybersecurity News. Follow us on Google News, LinkedIn, and X.