Ransomwarecritical
Half of Ransomware Access Due to Hijacked VPN Credentials
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-20333 | Authenticated Buffer Overflow RCE in Cisco ASA/FTD VPN Web Server | 9.9 | 71% | KEV | KEV |
| CVE-2025-20363 | A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software… | 9.0 | 7% | ||
| CVE-2025-53770 | Unauthenticated Deserialization RCE in Microsoft SharePoint Server on-premises | 9.8 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2025-54309 | Unauthenticated Admin Access Bypass in CrushFTP (CVE-2025-54309) | 9.8 | 93% | KEVPoC | KEV |
| CVE-2025-7775 | Actively Exploited Memory Overflow RCE/DoS in Citrix NetScaler ADC/Gateway | 9.2 | 21% | KEV | KEV |
From the original article
2 min read at infosecurity-magazine.com
Ransomware surged in Q3 2025, with just three groups accounting for the majority of cases (65%), and initial access most commonly achieved via compromised VPN credentials, according to Beazley Security. The Beazley Insurance subsidiary said Akira, Qilin and INC Ransomware were the most prolific groups in the third quarter, which saw 11% more leak posts than the previous three months.
By Phil Muncaster · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.