QuietCrabs and Thor Exploited RCE Flaws in Campaigns Against Russian Companies
Summary
Positive Technologies details attacks involving QuietCrabs and Thor, including rapid exploitation of SharePoint and Ivanti flaws, KrustyLoader and Sliver deployment, and telemetry indicating about 110 potential Russian company victims of Thor.
Key points
- QuietCrabs exploited Ivanti Endpoint Manager Mobile vulnerabilities CVE-2025-4427 and CVE-2025-4428, and SharePoint vulnerability CVE-2025-53770 soon after exploit material became available.
- QuietCrabs used an ASPX web shell and KrustyLoader to deliver Sliver implants; the analyzed KrustyLoader samples were Windows builds.
- Thor activity included reconnaissance, creation of a local administrator account, Active Directory discovery, privilege escalation, and collection of credentials and files.
- Thor used tools including ADRecon, GodPotato, secretsdump, Mimikatz, and Rclone; the report associates the group with LockBit and Babuk ransomware in other reporting.
- Telemetry identified about 145 servers scanned by Thor, 101 with vulnerabilities, and roughly 110 Russian companies as potential victims.
- Investigators say the two groups were active in the same victim infrastructure within days of each other, but found no evidence of collaboration.
- The report says early detection of Thor's noisier activity helped limit consequences and may have exposed QuietCrabs' presence.
Article Details
- Attack Vectors
- QuietCrabs exploited CVE-2025-4427 and CVE-2025-4428 in Ivanti Endpoint Manager Mobile and CVE-2025-53770 in Microsoft SharePoint to gain access and deploy a web shell and KrustyLoader.
- Thor exploited publicly known remote-code-execution vulnerabilities, including CVE-2021-27065, to gain initial access to vulnerable servers.
- Thor used PowerShell commands for reconnaissance and sent command results to its server; it also created a local account, used Active Directory reconnaissance and credential-dumping tools, and used Rclone to collect user files.
- Defensive Notes
- The article says mature security processes and well-designed infrastructure could have prevented or quickly contained the attacks.
- Monitor for exploitation of the vulnerabilities discussed, unexpected ASPX web shells, and the named attacker tooling and behaviors described in the article.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 143[.]198[.]8[.]180 | External server from which the JSP loader downloads KrustyLoader. |
| IPV4 | 95[.]142[.]40[.]51 | Thor server used for command-result collection, connectivity testing, and script delivery. |
| URL | hxxp[:]//95[.]142[.]40[.]51:654/exec[.]ps1 | Thor URL used to download a PowerShell script. |
| URL | hxxp[:]//95[.]142[.]40[.]51:888/?data= | Thor endpoint used to receive reconnaissance command results. |
| URL | hxxp[:]//95[.]142[.]40[.]51:8888/?data= | Thor endpoint used to receive the result of a connectivity check. |
| URL | hxxp[:]//omnileadzdev[.]s3[.]amazonaws[.]com/l9oWUjyPR6Gc | Specific cloud-hosted URL used to download KrustyLoader. |
MITRE ATT&CK
T1003 · OS Credential DumpingThor used secretsdump and mimikatz to extract credentials.T1033 · System Owner/User DiscoveryThor ran whoami /priv and sent the output to its server.T1055 · Process InjectionKrustyLoader injected and executed its payload in explorer.exe; the article also describes a sample configured to inject into cmd.exe.T1057 · Process DiscoveryThor ran tasklist and sent the output to its server.T1059.001 · PowerShellThe groups used PowerShell for reconnaissance, command execution, downloading files, and communicating results.T1082 · System Information DiscoveryThor ran systeminfo and sent the output to its server during reconnaissance.T1098 · Account ManipulationThor added the newly created srv account to the local administrator group.T1105 · Ingress Tool TransferQuietCrabs downloaded KrustyLoader and Thor downloaded PowerShell scripts and other utilities to compromised systems.T1136.001 · Local AccountThor created the local user account srv.T1190 · Exploit Public-Facing ApplicationQuietCrabs and Thor exploited remote-code-execution vulnerabilities on internet-accessible servers for initial access.T1482 · Domain Trust DiscoveryThor used nltest to enumerate domain controllers and trusted domains.T1505.003 · Web ShellQuietCrabs uploaded an ASPX web shell to a compromised SharePoint server for persistence and command execution.T1560 · Archive Collected DataThor used Rclone to collect user files.
CVE
CVE-2021-27065attackers exploited several remote code execution (RCE) vulnerabilities, including CVE-2025-53770 and CVE-2021-27065.CVE-2025-4427the exploitation of RCE vulnerabilities, including CVE-2025-53770 in Microsoft SharePoint, as well as CVE-2025-4427 and CVE-2025-4428 in Ivanti Endpoint Manager Mobile.CVE-2025-4428RCE vulnerabilities, including CVE-2025-53770 in Microsoft SharePoint, as well as CVE-2025-4427 and CVE-2025-4428 in Ivanti Endpoint Manager Mobile.CVE-2025-53770we identified malicious activity that involved the exploitation of RCE vulnerabilities, including CVE-2025-53770 in Microsoft SharePoint, as well as CVE-2025-4427 and CVE-2025-4428 in Ivanti Endpoint Manager Mobile.
People
Alexander BadayevThreat Intelligence Specialist at the Positive Technologies Expert Security Center and an article author.Klimentiy GalkinThreat Intelligence Specialist at the Positive Technologies Expert Security Center and an article author.Vladislav LuninLead Threat Intelligence Specialist of the Positive Technologies Expert Security Center Sophisticated Threat Research Group and an article author.
Threat Actors
APT27The article says some researchers link QuietCrabs to the larger APT27 group.QuietCrabsThreat group linked by the article to exploitation of vulnerabilities and deployment of KrustyLoader.Red Dev 61Listed as another name associated with QuietCrabs in the group profile.ThorThreat group the article attributes, with stated uncertainty, to attacks and scanning against Russian companies.UNC5221Name under which the article says QuietCrabs is also known.UTA0178Name under which the article says QuietCrabs is also known.
Malware
Babukobserved in attacks against Russian companies in 2025. As final payloads, the attackers use LockBit and Babuk ransomware, as well as Tactical RMM and MeshAgent to maintain persistence. For initial access, theyKrustyLoaderIn addition to the exploitation of vulnerabilities, we discovered samples of the KrustyLoader and Sliver malware, as well as traces of the Tactical RMM and MeshAgent tools.LockBitgroup first observed in attacks against Russian companies in 2025. As final payloads, the attackers use LockBit and Babuk ransomware, as well as Tactical RMM and MeshAgent to maintain persistence. For initial access,SliverIn addition to the exploitation of vulnerabilities, we discovered samples of the KrustyLoader and Sliver malware, as well as traces of the Tactical RMM and MeshAgent tools.
Vendors
Ivantiincluding CVE-2025-53770 in Microsoft SharePoint, as well as CVE-2025-4427 and CVE-2025-4428 in Ivanti Endpoint Manager Mobile.Microsoftmalicious activity that involved the exploitation of RCE vulnerabilities, including CVE-2025-53770 in Microsoft SharePoint, as well as CVE-2025-4427 and CVE-2025-4428 in Ivanti Endpoint Manager Mobile.
Products
Ivanti Endpoint Manager MobileCVE-2025-53770 in Microsoft SharePoint, as well as CVE-2025-4427 and CVE-2025-4428 in Ivanti Endpoint Manager Mobile.Microsoft SharePointactivity that involved the exploitation of RCE vulnerabilities, including CVE-2025-53770 in Microsoft SharePoint, as well as CVE-2025-4427 and CVE-2025-4428 in Ivanti Endpoint Manager Mobile.
Tools
ADReconThe group used the ADRecon utility, which they downloaded to C:\users\public\ad_ru.ps1, to perform Active Directory domain reconnaissance. The results were written to a file that the attackers later viewed:certutilThey also used certutil to download various PowerShell scripts:GodPotatoTo escalate privileges, the group used the publicly available GodPotato tool, and for data extraction they relied on utilities such as secretsdump and mimikatz.MeshAgentIn addition to the exploitation of vulnerabilities, we discovered samples of the KrustyLoader and Sliver malware, as well as traces of the Tactical RMM and MeshAgent tools.MimikatzTo escalate privileges, the group used the publicly available GodPotato tool, and for data extraction they relied on utilities such as secretsdump and mimikatz.RCloneData collected by the group included credentials for local and domain users, mail servers, and employees' Telegram sessions. To collect user files, they used Rclone.secretsdumpTo escalate privileges, the group used the publicly available GodPotato tool, and for data extraction they relied on utilities such as secretsdump and mimikatz.Tactical RMMIn addition to the exploitation of vulnerabilities, we discovered samples of the KrustyLoader and Sliver malware, as well as traces of the Tactical RMM and MeshAgent tools.
Countries
GermanyVictim geography The U.S., UK, Germany, South Korea, Russia, Taiwan, the Philippines, Iran, the Czech Republic, and a number of other countriesIranVictim geography The U.S., UK, Germany, South Korea, Russia, Taiwan, the Philippines, Iran, the Czech Republic, and a number of other countriesPhilippinesVictim geography The U.S., UK, Germany, South Korea, Russia, Taiwan, the Philippines, Iran, the Czech Republic, and a number of other countriesRussiaVictim geography The U.S., UK, Germany, South Korea, Russia, Taiwan, the Philippines, Iran, the Czech Republic, and a number of other countriesSouth KoreaVictim geography The U.S., UK, Germany, South Korea, Russia, Taiwan, the Philippines, Iran, the Czech Republic, and a number of other countriesTaiwanVictim geography The U.S., UK, Germany, South Korea, Russia, Taiwan, the Philippines, Iran, the Czech Republic, and a number of other countriesthe Czech RepublicVictim geography The U.S., UK, Germany, South Korea, Russia, Taiwan, the Philippines, Iran, the Czech Republic, and a number of other countriesUnited KingdomVictim geography The U.S., UK, Germany, South Korea, Russia, Taiwan, the Philippines, Iran, the Czech Republic, and a number of other countriesUnited StatesVictim geography The U.S., UK, Germany, South Korea, Russia, Taiwan, the Philippines, Iran, the Czech Republic, and a number of other countries
Industries
Defensepages. In both cases, the victims included not only small and medium-sized businesses but also defense industry enterprises, healthcare organizations, and research centers.Healthcarethe victims included not only small and medium-sized businesses but also defense industry enterprises, healthcare organizations, and research centers.ResearchLead Threat Intelligence Specialist of the Positive Technologies Expert Security Center Sophisticated Threat Research Group