Rapid Rise: DslogdRAT Malware Exploits Zero-Day in Japan Cyber Siege

Rapid Rise: DslogdRAT Malware Exploits Zero-Day in Japan Cyber Siege

At a glance

• DslogdRAT, a remote access trojan, has been planted on hacked Ivanti devices.
• Attackers exploited a zero-day in Ivanti Connect Secure to break into corporate networks in Japan.
• Japan is the focus, with consequences for its businesses and institutions.
• Security experts urge organizations to patch immediately.

What JPCERT/CC found

A new threat, DslogdRAT, has emerged in attacks on Japanese organizations. JPCERT/CC, Japan’s computer emergency response team, reported that attackers broke into networks around December 2024 by exploiting CVE-2025-0282, then a zero-day in Ivanti Connect Secure VPN appliances, and installed the malware afterward.

The Mechanics of DslogdRAT

The attack worked in stages. After exploiting the Ivanti flaw, the attackers installed a Perl web shell that ran commands for them and then dropped DslogdRAT, which supports remote shell commands, file uploads and downloads, and use of the infected device as a proxy. Its stealth is the worry: malware on a VPN appliance can sit there unnoticed for a long time.

The Impact on Japan

Japan is at the center of this campaign. Organizations there are on high alert as experts and officials work to contain the risk, and the danger goes beyond stolen data, with possible effects on national security and the economy.

Key Players in Mitigating the Threat

Security firms and government agencies are moving resources to respond. Ivanti has released patches for Connect Secure and urges customers to update immediately. Staying alert matters. So does investment in security infrastructure.

Lessons in Cybersecurity Preparedness

DslogdRAT shows how quickly attackers move once a zero-day appears, and businesses and governments everywhere need stronger defenses. Continuous monitoring, threat detection and timely patching are essential. International cooperation and information sharing among security teams also help.

Patch Ivanti now

DslogdRAT remains a serious threat, so everyone involved needs to act early. Install the latest patches. Teach employees to recognize threats. The campaign is another reminder that threats keep changing, and that collective vigilance and quick response decide how much damage attacks like this can do.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.