eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Ransomware Operators Exploiting Vulnerabilities in On-Premises SharePoint Servers
Bottom Line: Details have emerged on affiliates of the Warlock ransomware group targeting the vulnerability CVE-2025-53770 impacting on-premises SharePoint servers to conduct financially motivated attacks through the deployment of ransomware.
On August 20th, 2025, Trend Micro released a report highlighting a recently observed ransomware campaign, attributed to affiliates of the Warlock ransomware group. The attacks involved exploitation of the vulnerability CVE-2025-53770, impacting on-premises SharePoint servers, which was used to establish a foothold in target environments, leading to the deployment of Warlock ransomware. The financially motivated Warlock ransomware group was first observed in June 2025, operating under a Ransomware-as-a-Service (RaaS) model, making its debut on the underground Russian forum, RAMP. Since its debut, the group has claimed over 40 victims, ranging across various industries and government organizations from North America, Europe, Asia, and Africa.
CVE-2025-53770 (CVSS: 9.8) is a vulnerability within on-premises SharePoint servers, involving the deserialization of untrusted data that can allow an unauthenticated attacker to execute arbitrary code over the network. Microsoft published a blog post, along with an advisory for CVE-2025-53770, on July 19th, 2025, confirming that there was evidence of active exploitation in the wild. The vulnerability was disclosed along with CVE-2025-53771 (CVSS: 6.5), an improper authentication flaw within on-premises SharePoint servers that could enable attackers to perform spoofing over the network. Microsoft released relevant security patches on July 20th, 2025. These two vulnerabilities were observed being chained together under the name ToolShell, initially demonstrated during Pwn2Own Berlin 2025. These vulnerabilities bypass patches initially released for CVE-2025-49704 and CVE-2025-49706.
During the recently observed attacks, Trend Micro indicates that exploitation of CVE-2025-53770 was used to gain initial access to target environments, followed by threat actors activating the built-in guest accounts within Windows machines. Once the account was activated, the attackers changed its password and added it to the local "administrators" group, to establish administrative privileges. The attackers were then able to use the Windows Command Shell to execute script files, establishing Command-and-Control (C2) connections to remote file shares to copy files to the host, including the ransomware binary. The compromised IIS Worker Process tied to the vulnerable SharePoint application was utilized as a "launchpad for post-exploitation activities". Reconnaissance was performed using Living-of-the-Land Binaries (LOLBINS) and compromised services, along with the enumeration of running processes and termination of specific ones outlined within a retrieved text file. The threat actors performed credential and registry hive dumping to enable lateral movement and copied the ransomware binary to additional hosts via Server Message Block (SMB). Data was exfiltrated from compromised hosts using the RClone utility, and the ransomware binaries were used for data encryption. The threat actors were able to exploit CVE-2023-27532 (CVSS: 7.5), a vulnerability within Veeam Backup Software, in order to compromise the victim's backup infrastructure, hindering data recovery.
eSentire Threat Intelligence Analysis:
Within its blog post from July 19th, 2025, Microsoft stated that exploitation of CVE-2025-53770 and CVE-2025-53771 had been observed by Chinese state-sponsored APT groups Linen Typhoon and Violet Typhoon, who are known to conduct espionage-related attacks. The report also states that the threat actor Storm-2603, another threat group linked to China, was also reported to have been exploiting these vulnerabilities to deploy ransomware. Check Point Research published a report regarding Storm-2603 on July 31st, 2025, who were observed utilizing these vulnerabilities within attacks to deploy LockBit and Warlock ransomware. Within these attacks, Check Point Research notes the usage of Antivirus Terminator, a custom command line tool observed in the attacks, which abuses third-party drivers to terminate processes. Within their report, Trend Micro indicates that the threat actors deployed a binary used to terminate processes, with Trend Micro noting that the terminated processes involved Trend security products. Although both reports highlight the usage of Warlock ransomware, the observed tooling appears to differ, suggesting that the reported campaigns may involve different Warlock ransomware affiliates.
On August 21st, 2025, it was reported that Microsoft allegedly made changes to its Microsoft Active Protections Program (MAPP), which provides Proof-of-Concept (PoC) exploit code to some software vendors via early bug disclosures, in order to quickly provide updated protections to customers. The alleged changes involve limiting access to companies within countries that are "required to report vulnerabilities to their governments", which includes China, and involve providing more general descriptions of vulnerabilities rather than PoC exploit code. These changes follow the active exploitation of CVE-2025-53770 and CVE-2025-53771 by Chinese state sponsored APT groups, believed to be "linked to a leak of early bug disclosures". Following the initially observed attacks, PoC code was published online, enabling threat actors of all skill levels to make use of it within attacks. Due to reports of active exploitation and publicly available PoC exploit code, impacted organizations should apply relevant security patches as soon as possible.
In response to the disclosure of the vulnerabilities and reports of ongoing attacks, eSentire published an advisory for the vulnerabilities on July 21st, 2025. eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to CVE-2025-53770 and CVE-2025-53771. eSentire MDR for Network has detections in place to identify exploitation of CVE-2025-53770 and CVE-2023-27532, and eSentire MDR for Endpoint has detections to identify post-compromise and ransomware activity. eSentire's Threat Response Unit (TRU) covered the vulnerabilities within the August 2025 TRU Intelligence Briefing, and continues to track this topic for additional information and detection opportunities.
Behind the Curtain: How Lumma Affiliates Operate
Bottom Line: Lumma Stealer affiliates are operating a sophisticated cybercrime ecosystem, utilizing multiple information stealers, AI-assisted tools, and proxy networks to conduct simultaneous scam campaigns, with their stolen credentials being sold in underground marketplaces despite recent law enforcement disruptions.
On August 20th, 2025, Recorded Future’s Insikt Group published a report that revealed the operational mechanisms of Lumma Stealer’s cybercrime affiliates, including their modular deployment tools, rotating Command-and-Control (C2) infrastructure, and dynamic scam tactics. Insikt Group analyzed multiple Lumma affiliates and mapped a large, interconnected information-stealing ecosystem supported by proxy/VPN networks, anti-detect browsers, exploit/crypting services, and detection-evasion tooling.
Proxy services are the core tradecraft outlined in the report. Affiliates extensively used proxy services such as Pia Proxy, GhostSocks, ASocks, and FACELESS. Lumma partnered with GhostSocks to turn infected bots into SOCKS5 proxies, later added backconnect proxy access so that attacks appear to originate from the victim device, aiding cookie/token abuse. To facilitate large-scale fraudulent activities, members commonly utilized commercial VPNs and anti-detect/multi-account browsers (including Dolphin, Octo Browser, Adspower, Hidemyacc, Kameleo, and Brave) to hide their identity, location and digital fingerprints. Affiliates also relied on bulletproof hosting providers to host their C2 infrastructure, phishing content, and malware payloads. They frequently outsource stealth and delivery functions to external services such as the Hector exploit and crypting toolkit, cracked credential validation software, and AI-assisted phishing page generators like DONUSSEF.
In order to test the stealth of their malware, Lumma affiliates previously used AVCheck, but they have since shifted to alternatives such as KleenScan following the AVCheck takedown (May 2025). They also rely on communication tools such as uTox, Xabber, and Privnote, which provide secure, encrypted, and disposable communication channels. Disposable phone and SMS services such as OnlineSim and SMS-Activate, and Zadarma are commonly used to bypass one-time password protections and register accounts anonymously. The ecosystem thrives on underground forums such as Exploit, XSS, and LolzTeam, which serve as hubs for recruitment, training, and monetization. Russian Market was a major marketplace for Lumma logs, accounting for up to 92 percent of credential listings by late 2024. Affiliates also monetize stolen payment data through carding shops such as BriansClub, which provide a ready customer base and validation tools for payment fraud.
Beyond Lumma, affiliate members were observed using several infostealers simultaneously, such as Vidar, Stealc, Meduza Stealer, and CraxsRAT in order to diversify their operations and reduce the risk of disruptions. Some affiliates also orchestrate additional scams like rental fraud, often deploying stolen credentials from Lumma infections to deceive victims into paying fraudulent rental deposits.
eSentire Threat Intelligence Analysis:
The Lumma ecosystem demonstrates how modern cybercrime functions as a decentralized and resilient network. Affiliates quickly reconstitute their operations following disruptions, often reestablishing infrastructure in a matter of time. The affiliates’ ability to operate multiple infostealers and scams in parallel illustrates their operational sophistication and increases the campaign continuity. By diversifying both tools and monetization methods, affiliates reduce their dependency on a single infrastructure or malware family.
Between January 2025 and the end of April 2025, eSentire’s telemetry identified a steady number of incidents involving Lumma. However, a significant drop in Lumma incidents was observed starting in mid-May 2025, due to the joint effort between Europol, Microsoft, and other partners to disrupt Lumma Stealer activities. This involved the identification and seizure of malicious infrastructure, including a key control panel that was a vital piece of Lumma operations. Law enforcement actions have likely done significant and visible damage in the short-term to Lumma, however it remains to be seen whether Lumma’s operations will be rebuilt to the same scale it was prior to the takedown. eSentire has observed a handful of Lumma incidents post-takedown, but it is difficult to determine whether this signals that the developers are rebuilding and all of their customers are willing to work with them again, or all parties involved are taking a more subtle and cautious approach while evaluating options. One possible action that the developers take is one often seen with ransomware operators / developers, where they wind down operations under the existing “brand” and exit the scene, only to reappear later under a different name. These wind downs can include open-sourcing or selling their tools / code to increase the difficulty of attribution should the tooling reappear in the future.
eSentire maintains a number of detections for Lumma Stealer across both eSentire MDR for Network and Endpoint. For more information on Lumma Stealer and the Malware-as-a-Service (MaaS) operation check the TRU Positive Blog Lumma Stealer Malware Updated to Use ChaCha20 Cipher for Config Decryption and the October 2024 advisory Lumma Stealer ClickFix Distribution.
FBI Warns Russian Threat Actors Exploiting Unpatched Cisco Devices for Cyber Espionage
Bottom Line: The FBI issued an alert regarding a decade-long cyber espionage campaign attributed to Centre 16 of Russia's Federal Security Service. The threat actors leveraged a seven-year-old Cisco vulnerability, CVE-2018-0171, to infiltrate vulnerable critical infrastructure networks in the United States and across the globe.
On August 20th, 2025, the Federal Bureau of Investigation (FBI) published a Public Service Announcement (PSA) regarding the threat actor activity targeting End-of-Life (EoL) networking devices with an unpatched vulnerability CVE-2018-0171 in Cisco Smart Install (SMI). The activity has been ongoing for ten years and is attributed to the Russian Federal Security Service’s (FSB) Center 16, publicly referred to as Energetic Bear, Berserk Bear, Dragonfly, and Snake.
FSB Centre 16 was identified compromising networking devices that operated on legacy unencrypted protocols like SMI and Simple Network Management Protocol (SNMP) versions 1 and 2. The threat actors exploited CVE-2018-0171 (CVSS: 9.8) and SNMP community strings to gain unauthorized access to victim networks. They gathered configuration files from the impacted devices and modified the configuration files on certain devices to enable unauthorized access. The group was also observed deploying SYNful Knock, a Cisco firmware implant on few target devices to establish persistent remote access.
A report from Cisco Talos published on the same day highlighted the technical details around FSB Center 16’s espionage campaign. The activity was attributed to the Russian state-sponsored threat group, Static Tundra, believed to be a sub-cluster of FSB Center 16. Targeted organizations include telecommunications, higher education, and manufacturing sectors across North America, Asia, Africa, and Europe. The investigation revealed that the threat actors used custom tools to automate exploitation of CVE-2018-0171 against targeted IP addresses. The configuration data was exfiltrated via File Transfer Protocol (FTP), Trivial File Transfer Protocol (TFTP) or Remote Copy Protocol (RCP).
eSentire Threat Intelligence Analysis:
Critical infrastructure sectors are fundamental to national security, and unauthorized access to their networks represents a significant threat. Based on the industries targeted, Russian threat actors were likely seeking to exfiltrate sensitive information to support strategic or economic objectives. Such intelligence could provide a competitive advantage by revealing proprietary operations and developing technologies. The long-standing campaign conducted by FSB Center 16 underscores the adversary’s focus on exploiting insecure and outdated network devices as entry points. Such a sophisticated cyber espionage operation enables the collection of substantial volumes of sensitive information while maintaining the capability to utilize it in accordance with the sponsoring government’s evolving strategic objectives. Reports indicating that the campaign has been active for the past decade underscore the critical importance of implementing robust network monitoring. Long-standing and stealthy operations of this nature highlight how adversaries can persist undetected when visibility is limited.
Configuration files reveal the structure of a network, including connected devices, their roles, IP addresses, routing, firewall rules, and access controls, effectively giving attackers a detailed map of the environment without alerting defenders. They may contain credentials, SNMP strings, or VPN settings, allowing attackers to maintain persistent access even if some systems are patched or reset. With this knowledge, threat actors can prioritize high-value targets, identify weak points for privilege escalation or lateral movement, and deploy malware strategically. Furthermore, understanding the network topology and security rules enables them to evade detection and monitoring systems, while stolen configurations can be used to intercept, reroute, or replicate communications for intelligence gathering, even without directly accessing user data. Collectively, these capabilities have allowed state-sponsored threat actors linked to Russia and China to conduct long-term, targeted espionage campaigns in the past.
FSB Center 16’s campaign leveraged unpatched and EoL devices to facilitate unauthorized access to the target networks. Although CVE-2018-0171 was disclosed in March 2018, the threat actor was able to discover vulnerable EoL devices all over the world and exploit them. With the ongoing campaign demonstrating the continued risk of CVE-2018-0171 exploitation, Cisco has updated it’s existing security advisory to address the active abuse of this vulnerability. It is likely that other threat actors may conduct opportunistic financially motivated or espionage attacks in near future. Network devices operating on outdated versions of SNMP were similarly compromised by determining the community strings responsible to grant access to these devices. Vulnerabilities in EoL devices, especially edge devices if ignored can thus prove to be a severe threat to organization’s network.
Organizations are recommended to apply relevant security patches to mitigate CVE-2018-0171 and use SNMPv3 that provides encrypted authentication. It is critical for organizations to maintain a comprehensive asset inventory to identify EoL devices. Implementation of efficient vulnerability management and patch management system enables organizations to proactively avoid the risk of exploitation of known vulnerabilities. Organizations should also regularly monitor network traffic and audit device configurations to detect signs of compromise. Further, deploying Endpoint Detection and Response (EDR) solution will aid in identifying and containing threats such as SYNful Knock.
eSentire Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to CVE-2018-0171. eSentire MDR for Network has detections to identify activity associated with FSB Center 16, CVE-2018-0171, and SYNful Knock.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
