Ransomware Groups in East Asia Intensify Zero-Day Exploitation Tactics

Executive Summary

As of April 2026, ransomware groups in East Asia have escalated their use of zero-day vulnerabilities, leading to a notable increase in cyberattacks targeting critical infrastructure and enterprises. This trend underscores a significant shift in cybercriminal tactics, emphasizing the need for enhanced cybersecurity measures and proactive vulnerability management.

Current Threat Landscape

Zero-day vulnerabilities—previously unknown flaws in software that are exploited before a patch is available—have become a focal point for ransomware groups in East Asia. These vulnerabilities are often acquired through exploit brokers, who facilitate the sale and purchase of such exploits on the dark web. The high demand for zero-day exploits has led to a surge in their market value, with some remote code execution (RCE) exploits reaching prices up to $100,000. (me-en.kaspersky.com)

In 2025, a report by the Google Threat Intelligence Group revealed that nearly half of the 90 zero-day vulnerabilities exploited in the wild targeted enterprise-grade technology, marking an all-time high. This trend indicates a strategic shift by cybercriminals towards high-value targets within the enterprise sector. (cybersecuritydive.com)

Notable Incidents

In October 2025, the China-linked cyber espionage group known as Tick exploited a zero-day vulnerability in Motex Lanscope Endpoint Manager, tracked as CVE-2025-61932. This flaw allowed remote attackers to execute arbitrary commands with SYSTEM privileges on compromised systems, leading to the deployment of backdoors for further exploitation. (thehackernews.com)

Additionally, in May 2025, multiple ransomware groups and Chinese Advanced Persistent Threat (APT) actors targeted two critical vulnerabilities in SAP NetWeaver, CVE-2025-31324 and CVE-2025-42999. These flaws permitted remote code execution without authentication, facilitating the deployment of web shells and subsequent malicious activities. (securityweek.com)

Implications for Cybersecurity

The increasing exploitation of zero-day vulnerabilities by ransomware groups in East Asia presents several challenges:

• Enhanced Evasion Techniques: Zero-day exploits enable attackers to bypass traditional detection mechanisms, making it more difficult for organizations to identify and mitigate threats promptly.

• Accelerated Attack Timelines: The use of zero-day vulnerabilities allows cybercriminals to initiate attacks more swiftly, reducing the window for defensive responses.

• Elevated Risk to Critical Infrastructure: Targeting enterprise-grade technologies and critical infrastructure increases the potential impact of cyberattacks, potentially disrupting essential services and operations.

Recommendations

To mitigate the risks associated with zero-day exploitation, organizations should consider the following measures:

• Proactive Vulnerability Management: Implement comprehensive vulnerability scanning and patch management processes to identify and address known and potential vulnerabilities promptly.

• Enhanced Monitoring and Detection: Deploy advanced intrusion detection systems capable of identifying anomalous behaviors indicative of zero-day exploitations.

• Collaboration with Threat Intelligence Providers: Engage with reputable threat intelligence services to stay informed about emerging threats and vulnerabilities, facilitating timely defensive actions.

By adopting these strategies, organizations can strengthen their cybersecurity posture against the evolving threat landscape characterized by sophisticated ransomware groups in East Asia.

Highlights:

• China-Linked Tick Group Exploits Lanscope Zero-Day to Hijack Corporate Systems, Published on Thursday, October 30
• Ransomware Groups, Chinese APTs Exploit Recent SAP NetWeaver Flaws - SecurityWeek, Published on Wednesday, May 14
• Nearly half of exploited zero-day flaws target enterprise-grade technology | Cybersecurity Dive, Published on Thursday, March 05