Chinese State-Backed Hackers Exploit Ivanti Vulnerabilities to Breach French Government and Major Industries

China-Linked Cyber Attackers Compromise French Government via Ivanti Zero-Day Exploits

In late 2024, the French government and several commercial sectors including telecom, finance, and transportation, fell victim to a sophisticated cyber attack perpetrated by Chinese state-sponsored hackers. Utilizing multiple zero-day vulnerabilities in Ivanti Cloud Services Appliance (CSA) devices, threat actors managed to infiltrate sensitive networks and access valuable data, raising urgent cybersecurity concerns across Europe and beyond.

Details of the Zero-Day Exploits

The French National Agency for the Security of Information Systems (ANSSI) officially confirmed that the breaches exploited three critical Ivanti CSA vulnerabilities: CVE-2024-8963, CVE-2024-9380, and CVE-2024-8190. At the time of the incidents, these flaws were unpatched, giving attackers an opportunity to steal login credentials, establish long-term persistence on affected systems, and evade detection.

Cybersecurity researchers observed various techniques employed during the attack, including the deployment of advanced PHP web shells, modification of legitimate PHP scripts to introduce remote shell functionalities, and installation of malicious kernel modules acting as rootkits.

The Houken Group and Its Tactics

The coordinated attacks have been attributed to the notorious Houken group, previously linked to high-profile exploits involving SAP NetWeaver vulnerabilities and the use of custom GoReShell backdoors. According to threat intelligence experts, Houken shares notable operational similarities with the group UNC5174, recently tracked by Google’s Mandiant team.

Houken's strategy involves leveraging both cutting-edge zero-day exploits and an arsenal of open-source tools, predominantly developed by Chinese-speaking programmers. Their infrastructure is decentralized, leveraging commercial VPN services and dedicated servers to mask their activities and increase resilience against takedowns.

Global Reach and Ongoing Risks

While Houken has previously targeted government and education sectors across Southeast Asia, China, Hong Kong, and Macau, the group’s activity in Western countries has concentrated on critical verticals such as government agencies, defense institutions, academia, media, and telecom operators.

The investigation suggests this cyber operation was not the work of a single entity. Instead, it points to a coordinated scheme in which one group specialized in initial network access and later sold this access to other attackers seeking sensitive intelligence or proprietary data, illustrating the growing market for initial access brokerage in the cybercrime community.

Implications for Cybersecurity and Market Response

This large-scale cyberattack highlights the strategic importance of real-time vulnerability management and the potential risks of unpatched cloud service appliances within critical infrastructure sectors. For organizations relying on Ivanti appliances or similar cloud-management platforms, adopting proactive patch management and layered security solutions is essential to mitigate present and future cyber threats.

Additionally, this incident underscores the ongoing evolution of cybercrime marketplaces and the necessity for global collaboration in threat intelligence and incident response.