Ransomwarecritical

How a noisy ransomware intrusion exposed a long-term espionage foothold

Help Net Securityby @zeljkazorzDec 2, 2025 · 00:00 UTC (Dec 2, 2025)2 min read2 · 1 read

Read at helpnetsecurity.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2025-53770 CVE-2024-21887 CVE-2025-4427 CVE-2025-4428 CVE-2023-38035

Tags: cve-2025-53770 cve-2024-21887 cve-2025-4427 cve-2025-4428 cve-2023-38035 ransomware

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2023-38035	Authentication Bypass in Ivanti Sentry (MobileIron Sentry) Admin Interface	9.8	100%	KEVRansomwarePoC	Aug 21, 2023 KEV Aug 22, 2023
CVE-2024-21887	Command Injection RCE in Ivanti Connect Secure and Policy Secure	9.1	100%	KEVRansomwarePoC	Jan 12, 2024 KEV Jan 10, 2024
CVE-2025-4428 +1 related CVE CVE-2025-4427	Authenticated Code Injection RCE in Ivanti Endpoint Manager Mobile (EPMM) API	8.8 group max	88%	KEV	May 13, 2025 KEV May 19, 2025
CVE-2025-53770	Unauthenticated Deserialization RCE in Microsoft SharePoint Server on-premises	9.8	100%	KEVRansomwarePoC ×3	Jul 20, 2025 KEV Jul 20, 2025

From the original article

2 min read at helpnetsecurity.com

Getting breached by two separate and likely unconnected cyber attack groups is a nightmare scenario for any organization, but can result in an unexpected silver lining: the noisier intrusion can draw attention to a far stealthier threat that might otherwise linger undetected for months.

Help Net Security

By @zeljkazorz · helpnetsecurity.com

Read the full article at Help Net Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.