State-Backed Intrusions Exploit RDP, VPN, SSH, and Supply Chains for Initial Access

Russian and China-linked threat activity has relied on common but effective entry points to penetrate government, telecom, defense, energy, and other critical-sector networks. Ukrainian officials said CERT-UA recorded 5,927 cyber incidents in 2025, a 37.4% increase over the prior year, with Russian groups including UAC-0002 (Sandworm), UAC-0001 (APT28), UAC-0010 (Gamaredon), and UAC-0190 (Void Blizzard) using exposed RDP services, vulnerable VPN appliances, supply-chain compromise, phishing, and stolen credentials to gain access. Separately, telecom intrusions tied to the China-linked cluster UAT-9244 used exposed web applications, ProxyLogon, exposed SSH services, weak credentials, and unpatched server software to establish footholds in Linux-heavy environments.

Once inside, the actors deployed a broad toolset for espionage, persistence, and disruption, including RATs, stealers, ransomware, wipers, and Linux malware such as PeerTime, which supports multiple architectures and uses peer-to-peer, BitTorrent-like communications to avoid reliance on centralized command-and-control. The reporting highlights exploitation of products including Cisco ASA/AnyConnect, Roundcube, Fortinet, WinRAR, 7-Zip, and legacy Microsoft Office components, alongside social-engineering tactics such as ClickFix, device-code phishing, OAuth phishing, and QR-code hijacking. The campaigns also abused legitimate services and native system tools, while under-monitored embedded Linux devices, routers, edge systems, and container hosts were described as especially attractive for long-term persistence, lateral movement, scanning, and covert communications.