SecuriTricks - CVE-2025-4428

Dragons in Thunder

This report details the activities of two hacker groups, QuietCrabs and Thor, targeting Russian companies. QuietCrabs exploited RCE vulnerabilities in Microsoft SharePoint and Ivanti Endpoint Manager Mobile, using KrustyLoader and Sliver malware. Thor employed more common tools and techniques, atta…

lockbit

ivanti

Published: November 28, 2025

Linked vulnerabilities : CVE-2021-27065, CVE-2025-4428, CVE-2025-4427, CVE-2025-53770 (CVSS 9.8)

Downloadable IOCs: 75

The Mystery OAST Host Behind a Regionally Focused Exploit Operation

A long-running, attacker-operated OAST service on Google Cloud has been observed driving a focused exploit operation. The actor combines stock Nuclei templates with custom payloads to expand their reach. All observed activity targeted canaries deployed in Brazil, indicating a deliberate regional fo…

scanning infrastructure

Published: November 28, 2025

Linked vulnerabilities : CVE-2025-4428, CVE-2025-2611 (CVSS 9.3)

Downloadable IOCs: 9

China-Nexus Threat Actor Actively Exploiting Ivanti Endpoint Manager Mobile (CVE-2025-4428) Vulnerability

A critical vulnerability in Ivanti Endpoint Manager Mobile (EPMM) is being actively exploited by a China-nexus threat actor, UNC5221. The exploitation targets internet-facing EPMM deployments across various sectors including healthcare, telecommunications, and government. The attackers utilize unau…

Published: May 21, 2025

Linked vulnerabilities : CVE-2025-22457 (CVSS 9.0), CVE-2025-31324 (CVSS 10.0), CVE-2025-4428, CVE-2025-4427

Downloadable IOCs: 12

Tag: CVE-2025-4428

Attack reports

Dragons in Thunder

The Mystery OAST Host Behind a Regionally Focused Exploit Operation

China-Nexus Threat Actor Actively Exploiting Ivanti Endpoint Manager Mobile (CVE-2025-4428) Vulnerability