Threat Intelligence Roundup Covers Vishing, Zero-Day Exploits and Cybercrime Takedown
Summary
The roundup covers vishing used to steal SaaS credentials, exploited SolarWinds and Dell flaws, the FBI’s RAMP forum seizure, ransomware evasion, Ivanti exploitation, a thwarted attack on Poland’s energy systems, and WinRAR-based espionage.
Key points
- Mandiant reported vishing and credential-harvesting attacks aimed at stealing SSO credentials and MFA codes to access SaaS environments.
- Unknown hackers are exploiting SolarWinds Web Help Desk vulnerability CVE-2025-40551 to gain persistent access, including through a Zoho Assist agent.
- The FBI seized the RAMP cybercrime forum’s Tor site and clearnet domain; its administrator said there were no plans for a successor.
- Google’s threat intelligence team linked UNC6201 to exploitation of Dell RecoverPoint for Virtual Machines flaw CVE-2026-22769 and deployment of SLAYSTYLE, BRICKSTORM, and Grimbolt malware.
- The Reynolds ransomware family uses a vulnerable driver to disable EDR tools, while GreyNoise attributed 83% of observed Ivanti EPMM exploitation sessions to one IP address.
- Polish officials said systems prevented a Sandworm-linked DynoWiper attack targeting energy infrastructure in December 2025.
- A China-linked group used WinRAR vulnerability CVE-2025-8088 in espionage campaigns targeting government and law-enforcement organizations in Southeast Asia.
Article Details
- Event Type
- Threat intelligence roundup covering cybercrime forum seizure, vulnerability exploitation, ransomware, espionage, and attempted destructive attacks.
- Impact
- Reported activity included theft of SSO credentials and MFA codes, persistent access to compromised environments, exploitation of vulnerabilities in SolarWinds WHD, Dell RecoverPoint for Virtual Machines, Ivanti EPMM, and WinRAR, and attacks targeting organizations in multiple sectors. An attempted wiper attack against Poland’s energy systems was reportedly prevented; the article does not report comparable outcomes for the other incidents.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ramp4u[.]io | Clearnet domain of the RAMP cybercrime forum, which advertised malware and hacking services; the FBI seized the forum and the domain was taken offline. |
| IPV4 | 193[.]24[.]123[.]42 | IP address associated with 83% of observed Ivanti EPMM exploitation sessions; described as bulletproof infrastructure. |
CVE
CVE-2025-40551CISA flagged a critical SolarWinds Web Help Desk (WHD) vulnerability, CVE-2025-40551, that is now being exploited by unknown hackers.CVE-2025-8088Threat actors abused a now-patched security vulnerability (CVE-2025-8088) in RARLAB WinRAR, which permits arbitrary code execution upon opening a specially crafted archive.CVE-2026-1281Recent threat intelligence observations link one threat actor to two critical vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in Ivanti Endpoint Manager Mobile (EPMM).CVE-2026-1340Recent threat intelligence observations link one threat actor to two critical vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in Ivanti Endpoint Manager Mobile (EPMM).CVE-2026-22769Chinese state hacking group, UNC6201, is believed to be behind a zero-day exploitation of in Dell RecoverPoint for Virtual Machines, tracked as CVE-2026-22769.
People
Threat Actors
Amaranth-DragonChina-linked threat actor connected with cyber espionage campaigns targeting government and law enforcement in Southeast Asia.SandwormRussian state-sponsored group linked to an attempted DynoWiper attack against Poland’s energy systems.ShinyHuntersNamed in the report as the group also identified parenthetically as UNC6240; the roundup describes related vishing and credential-harvesting tactics.UNC6201Believed to be behind zero-day exploitation of Dell RecoverPoint for Virtual Machines, with persistent access involving malware.UNC6240Activity cluster Mandiant identifies parenthetically as ShinyHunters; monitored in connection with vishing and credential-harvesting activity.UNC6661Activity cluster Mandiant is monitoring in connection with vishing and credential-harvesting activity.UNC6671Activity cluster Mandiant is monitoring in connection with vishing and credential-harvesting activity.
Malware
BRICKSTORMThe high-risk vulnerability has been exploited since May 2024 and shows persistent access of the malware SLAYSTYLE and BRICKSTORM.DYNOWIPERIn late December 2025, the Russian state sponsored hacking groups, Sandworm, attempted to deploy a destructive “data-wiping malware” called DynoWiper against Poland’s power grid.GRIMBOLTAdditionally, UNC6201 deploys a newly identified malware called Grimbolt, which leverages a technique that is faster and more difficult to analyze than BRICKSTORM.Reynolds5. Reynolds Ransomware Embeds BYOVD Driver to Disable EDR Security Tools – The Hacker NewsSLAYSTYLEThe high-risk vulnerability has been exploited since May 2024 and shows persistent access of the malware SLAYSTYLE and BRICKSTORM.
Vendors
Dell4. Chinese hackers exploiting Dell zero-day flaw since mid-2024 – BleepingComputerIvanti6. One threat actor responsible for 83% of recent Ivanti RCE attacks – BleepingComputerNsecSoftWhile similar techniques have been observed in prior attacks, the Reynolds campaign specifically drops a vulnerable NsecSoft NSecKrnl driver and terminates processes associated with multiple security programs.RARLABThreat actors abused a now-patched security vulnerability (CVE-2025-8088) in RARLAB WinRAR, which permits arbitrary code execution upon opening a specially crafted archive.SolarWinds2. Hackers exploit SolarWinds WHD flaws to deploy DFIR tool in attacks – BleepingComputerZohoUsing legitimate tools, such as Zoho ManageEngine, threat actors were able to target organizations and maintain persistent, hands-on access to compromised environments.
Products
Dell RecoverPoint for Virtual MachinesChinese state hacking group, UNC6201, is believed to be behind a zero-day exploitation of in Dell RecoverPoint for Virtual Machines, tracked as CVE-2026-22769.Ivanti Endpoint Manager Mobile (EPMM)Recent threat intelligence observations link one threat actor to two critical vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in Ivanti Endpoint Manager Mobile (EPMM).NsecSoft NSecKrnlWhile similar techniques have been observed in prior attacks, the Reynolds campaign specifically drops a vulnerable NsecSoft NSecKrnl driver and terminates processes associated with multiple security programs.SolarWinds Web Help Desk (WHD)CISA flagged a critical SolarWinds Web Help Desk (WHD) vulnerability, CVE-2025-40551, that is now being exploited by unknown hackers.WinRAR8. China-Linked Amaranth-Dragon Exploits WinRAR Flaw in Espionage Campaigns – The Hacker NewsZoho ManageEngineUsing legitimate tools, such as Zoho ManageEngine, threat actors were able to target organizations and maintain persistent, hands-on access to compromised environments.Zoho ManageEngine AssistFollowing initial access, attackers installed the Zoho ManageEngine Assist agent from an MSI hosted on the Catbox file-sharing platform, configured it for unattended access, and registered the affected host with a Zoho
Countries
Industries
Energy7. Sandworm hackers linked to failed wiper attack on Poland’s energy systems – BleepingComputerGovernmentThroughout 2025, Amaranth-Dragon, a China-linked threat actor has been connected with new cyber espionage campaigns targeting government and law enforcement in Southeast Asia.Law enforcementThroughout 2025, Amaranth-Dragon, a China-linked threat actor has been connected with new cyber espionage campaigns targeting government and law enforcement in Southeast Asia.