Threat actorcriticalExploited in the wild

Amazon warns that Russia’s Sandworm has shifted its tactics

CyberScoopby @CyberScoopNewsDec 16, 2025 · 15:54 UTC (Dec 16, 2025)4 min read1

Read at cyberscoop.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2022-26318 CVE-2021-26084 CVE-2023-22518 CVE-2023-27532

Tags: cve-2022-26318 cve-2021-26084 cve-2023-22518 cve-2023-27532 threat-actor

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-26084	Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability	9.8	100%	KEVRansomwarePoC	Aug 30, 2021 KEV Nov 3, 2021
CVE-2022-26318	Unauthenticated RCE in WatchGuard Firebox and XTM Fireware OS	9.8	78%	KEV	Mar 4, 2022 KEV Mar 25, 2022
CVE-2023-22518	Improper Authorization in Atlassian Confluence Data Center and Server	9.8	100%	KEVRansomwarePoC	Oct 31, 2023 KEV Nov 7, 2023
CVE-2023-27532	Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials	7.5	81%	KEVRansomware	Mar 10, 2023 KEV Aug 22, 2023

From the original article

4 min read at cyberscoop.com

Researchers said attackers linked to Russia’s military intelligence agency have moved from vulnerability exploits to focus on poorly configured network edge devices to keep its access to target networks.

CyberScoop

By @CyberScoopNews · cyberscoop.com

Read the full article at CyberScoop

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.