Top 10 Most Exploited CVEs by APT Groups (2020–2025)

Introduction

From 2020 to 2025, a handful of vulnerabilities shaped the battlefield of nation-state operations. Advanced Persistent Threat groups turned them into gateways for lasting access, steady intelligence theft, and selective disruption when it served their objectives.

This dossier is the Noorstream operational reference: timeline, kill-chain mechanics, operator-grade case studies, adversary doctrine, and high-consequence scenarios. Read it as doctrine: patch fast, hunt always, own the edge.

---

Historical Evolution

• 2019–2020: VPNs and load balancers (Pulse Secure, F5) exploited heavily as remote work surged.
• 2021: Mass exploitation era. Exchange (ProxyLogon) and Log4Shell drove tens of thousands of compromises.
• 2022: Collaboration platforms (Confluence) became initial-access vectors.
• 2023: Client-side tools (WinRAR) and routers (Cisco IOS XE) were exploited at scale.
• 2024: Zero-days in PAN-OS and Ivanti proved edge appliances are strategic high-ground.

---

Exploitation Timeline

• Apr 2019 (disclosed) — CVE-2019-11510 (Pulse Secure) — Exploited through 2021 by APT10/APT41.
• Jul 2020 (disclosed) — CVE-2020-5902 (F5 BIG-IP TMUI) — Exploited within days by China-linked APTs and ransomware groups.
• Mar 2021 (public exploitation) — CVE-2021-26855 (Exchange ProxyLogon chain) — HAFNIUM and others; ~60,000 organizations impacted.
• Sep 21, 2021 (disclosed) — CVE-2021-22005 (VMware vCenter) — Exploited within weeks by espionage groups.
• Dec 9, 2021 (disclosed) — CVE-2021-44228 (Log4j) — Weaponized within 24 hours; global exploitation.
• Jun 2, 2022 (disclosed, actively exploited as zero-day) — CVE-2022-26134 (Atlassian Confluence) — 19,707 instances exposed.
• Aug 2023 (disclosed) — CVE-2023-38831 (WinRAR) — APT29 targeted diplomatic missions via crafted archives.
• Oct 2023 (disclosed) — CVE-2023-20198 (Cisco IOS XE) — >40,000 routers implanted worldwide.
• Apr 2024 (zero-day exploitation observed) — CVE-2024-3400 (PAN-OS GlobalProtect) — Used in targeted telecom/government intrusions.
• Jan 10, 2024 (disclosed, chained exploit) — CVE-2024-21887 (Ivanti Connect Secure) — UNC5325/UNC5330 infiltrated U.S. federal agencies.

---

CVE → Exploit Class → APT Intel Cards

CVE-2019-11510 – Pulse Secure VPN

• Exploit Class: Arbitrary file read
• Actors: APT10, APT41
• Persistence: Stolen creds → valid accounts, lateral RDP/SMB
• Impact: 42,000+ appliances exposed; exploitation confirmed through 2021
• Indicators: New local accounts, anomalous logins from foreign IPs

CVE-2020-5902 – F5 BIG-IP

• Exploit Class: TMUI RCE
• Actors: China-linked APTs, ransomware affiliates
• Persistence: Root shell, cron jobs, SSL cert tampering
• Impact: ~1,000 devices confirmed exposed (Shodan)
• Indicators: Altered configs, untrusted SSL certs

CVE-2021-26855 – Microsoft Exchange (ProxyLogon)

• Exploit Class: SSRF/Auth bypass chain
• Actors: Hafnium, multiple state actors
• Persistence: IIS webshells, token replay
• Impact: ~60,000 organizations compromised
• Indicators: Webroot ASPX shells, mailbox export anomalies

CVE-2021-44228 – Apache Log4j (Log4Shell)

• Exploit Class: JNDI RCE
• Actors: Multi-APT, ransomware groups
• Persistence: Remote loaders, chained payloads
• Impact: Millions of applications vulnerable worldwide
• Indicators: Outbound LDAP/JNDI calls, unusual java spawns

CVE-2021-22005 – VMware vCenter

• Exploit Class: Arbitrary file upload → RCE
• Actors: China-linked APTs, ransomware affiliates
• Persistence: Webshells inside mgmt VMs
• Impact: >7,000 instances exposed on internet
• Indicators: Suspicious uploads, abnormal VM snapshots

CVE-2022-26134 – Atlassian Confluence

• Exploit Class: OGNL injection → RCE
• Actors: Espionage groups, cryptominers
• Persistence: Webshells, miner processes
• Impact: 19,707 vulnerable instances (Unit 42)
• Indicators: OGNL payload traffic, rogue webapp artifacts

CVE-2023-38831 – WinRAR

• Exploit Class: Archive parsing RCE
• Actors: APT29, DarkPink, others
• Persistence: DLL drops, scheduled tasks
• Impact: Targeted diplomatic/government campaigns
• Indicators: Explorer.exe spawns unusual processes, new tasks

CVE-2023-20198 – Cisco IOS XE

• Exploit Class: WebUI auth bypass
• Actors: China-linked APTs
• Persistence: NVRAM implants, hidden configs
• Impact: >40,000 devices implanted worldwide
• Indicators: Hidden processes, routing anomalies

CVE-2024-3400 – PAN-OS GlobalProtect

• Exploit Class: Command injection (zero-day)
• Actors: Volt Typhoon, Chinese espionage units
• Persistence: Arbitrary file writes, stealth implants
• Impact: Limited but strategic (telecom/government)
• Indicators: Child PAN processes, suspicious file activity

CVE-2024-21887 – Ivanti Connect Secure

• Exploit Class: Command injection (chained with CVE-2023-46805)
• Actors: UNC5325, UNC5330
• Persistence: Gateway tunnels, credential replay
• Impact: Breach extended to U.S. CISA networks
• Indicators: New tunnels, altered ACLs, replay attempts

---

Technical Breakdown

• Weaponization Windows:
  • Log4j: weaponized within 24h of disclosure.
  • Others: adoption varied days to weeks, depending on exploit code release and patch lag.
• Persistence (anchored to case studies):
  • Exchange → IIS webshells.
  • WinRAR → DLL drops, scheduled tasks.
  • Cisco IOS XE → NVRAM implants.
  • Confluence → OGNL webshells, cryptominers.
• Detection Heuristics:
  • Outbound LDAP/JNDI (Log4j).
  • Abnormal VM snapshotting (vCenter).
  • Webroot ASPX shells (Exchange).
  • Explorer-spawned processes (WinRAR).
  • Routing anomalies (Cisco IOS XE).

---

Strategic Implications

• Defenders: Patch edge devices within 72 hours; enforce config integrity; mandatory post-patch hunts.
• Regulators: KEV deadlines with enforcement teeth; vendor accountability clauses.
• Adversaries: Proved doctrine of speed, chaining, persistence at the edge is decisive.

---

Future Outlook

• AI-driven exploit discovery in OT/edge gear → faster weaponization.
• IT→OT chaining → VPN/router exploit leading to OT disruption.
• State-masked ransomware → APT implants used as criminal fronts.

---

Conclusion

The lesson of 2020–2025 is simple. Security is not defended by optimism but by discipline.

The triad remains clear: Speed (72-hour patch SLA), Visibility (hunt and validate), Accountability (hold vendors responsible).