Zero-Day Weaponization: APT Groups Exploit Unpatched Vulnerabilities in South Asia

Executive Summary

Advanced Persistent Threat (APT) groups in South Asia are increasingly exploiting zero-day vulnerabilities, leading to heightened cyber threats in the region. These state-sponsored actors are leveraging unpatched exploits to infiltrate critical infrastructure, steal sensitive information, and disrupt operations. The weaponization of zero-day vulnerabilities has become a significant concern for cybersecurity professionals and organizations operating within South Asia.

Introduction

Zero-day vulnerabilities—flaws in software that are unknown to the vendor and lack a patch—pose a substantial risk to cybersecurity. When these vulnerabilities are weaponized by APT groups, they can lead to severe consequences, including data breaches, system compromises, and operational disruptions. In South Asia, the exploitation of such vulnerabilities has been on the rise, with several APT groups actively targeting organizations in the region.

APT Groups Exploiting Zero-Day Vulnerabilities

1. Lazarus Group (North Korea)

   The Lazarus Group has demonstrated exceptional operational sophistication, executing campaigns that combine zero-day exploitation, supply chain compromise, and artificial intelligence-enhanced social engineering. In 2025, they targeted South Korean organizations by exploiting vulnerabilities in South Korean software products, including Innorix Agent. The group employed watering hole attacks, redirecting desired targets to attacker-controlled infrastructure hosting exploit code. (linkedin.com)

2. RedJuliett (China)

   Between November 2023 and April 2024, RedJuliett, a Chinese state-sponsored group, exploited known vulnerabilities in network edge devices such as firewalls, VPNs, and load balancers to gain initial access. Operating from Fuzhou, China, RedJuliett targeted organizations in Taiwan, Hong Kong, Malaysia, Laos, South Korea, the United States, Djibouti, Kenya, and Rwanda. The group utilized SQL injection and directory traversal exploits against web and SQL applications, in addition to targeting internet-facing device vulnerabilities. (cyfirma.com)

3. SideWinder (China)

   Active since at least 2012, SideWinder has been targeting high-profile entities in South Asia. In a recent investigation, Kaspersky researchers discovered a previously unknown, final-stage tool named “StealerBot” used by the group. This advanced modular implant is specifically developed for espionage, employing obfuscation layers and anti-analysis techniques. The group has targeted sectors including government and military entities, logistics companies, telecommunications, financial institutions, universities, and oil trading companies across countries such as Bangladesh, Djibouti, Jordan, Malaysia, the Maldives, Myanmar, Nepal, Pakistan, Saudi Arabia, Sri Lanka, Turkey, and the United Arab Emirates. (ics-cert.kaspersky.com)

Exploit Broker Transactions

The acquisition and sale of zero-day vulnerabilities by exploit brokers have become a significant concern. In February 2026, the U.S. Department of the Treasury sanctioned Sergey Sergeyevich Zelenyuk and his company, Matrix LLC (doing business as Operation Zero), for their acquisition and distribution of cyber tools harmful to U.S. national security. Operation Zero has been known to trade in exploits, including those targeting U.S.-built software, and has offered rewards for such exploits. (home.treasury.gov)

Conclusion

The weaponization of zero-day vulnerabilities by APT groups in South Asia represents a significant and evolving threat to regional cybersecurity. Organizations must prioritize the identification and patching of vulnerabilities, enhance threat detection capabilities, and foster international collaboration to mitigate the risks associated with these sophisticated cyber threats.

Highlights:

• The threat environment has shifted from opportunistic attacks to coordinated campaigns., Published on Sunday, November 09
• APT Quarterly Highlights : Q2 2024 - CYFIRMA, Published on Thursday, July 18
• APT and financial attacks on industrial organizations in Q4 2024 | Kaspersky ICS CERT, Published on Monday, March 24