Blog

Cybereason TTP Briefing Q4 2025: Diverse Phishing Tactics and RATs on the Rise

Cybereason Consulting Team — Thu, 05 Feb 2026 12:54:25 GMT

Explore the latest trends, techniques, and procedures (TTPs) our incident response (IR) experts are actively facing with the TTP Briefing Q4 2025, a report built on frontline threat intelligence from our global incident response investigations, enriched by noteworthy detections from our SOC.

Fake Installer: Ultimately, ValleyRAT infection

Cybereason Security Services Team — Tue, 03 Feb 2026 11:35:56 GMT

Cybereason Security Services issue Threat Analysis reports to inform on impacting threats. The Threat Analysis reports investigate these threats and provide practical recommendations for protecting against them.

In this Threat Analysis report, Cybereason Security Services investigates a fake installer attack we recently observed multiple times. We identified some findings that have not been documented in previous reports and obtained new threat intelligence insights from the malwares.

Identity & Beyond: 2026 Incident Response Predictions

Cybereason Security Services Team — Fri, 09 Jan 2026 22:54:46 GMT

In 2026, incident response (IR) will continue its shift away from traditional malware-centric investigations toward identity-driven intrusions, abuse of trusted cloud services, and low-signal, high-impact activity that blends seamlessly into normal business operations. Rather than relying on technical exploits, threat actors are prioritizing legitimate access, persistence, and operational efficiency, enabling them to evade users, security controls, and automated detection.

Cybereason Nails 2025 MITRE ATT&CK® Enterprise Evaluation

Cybereason Security Services Team — Tue, 16 Dec 2025 18:58:08 GMT

Flawless detection and protection against the industry’s most rigorous adversary emulation, proving Cybereason’s real-world effectiveness

CVE-2025-55182: Critical Vulnerability, React2Shell, Allows for Unauthenticated RCE

Cybereason Consulting Team — Fri, 05 Dec 2025 18:04:47 GMT

Cybereason is continuing to investigate. Check the Cybereason blog for additional updates.

KEY TAKEAWAYS

Critical vulnerability discovered on December 3, 2025 in React that could allow for unauthenticated remote code execution.
Cybereason experts have dubbed this vulnerability as trivial to exploit.
Issue allows the server to incorrectly trust user-supplied identifiers and fails to verify.
Initial working proof of concept is public and attributed to Chinese threat actors.
If server was exposed to public internet prior to patch release date (December 3, 2025), investigate for signs of compromise.
Update to latest patched versions of React, and review advisory for additional recommendations.

License to Encrypt: “The Gentlemen” Make Their Move

Cybereason Security Services Team — Tue, 18 Nov 2025 13:59:59 GMT

Cybereason Threat Intelligence Team recently conducted an analysis of "The Gentlemen" ransomware group, which emerged around July 2025 as a ransomware threat actor group with relatively advanced methodologies. The Gentlemen group employs a dual-extortion strategy, not only encrypting sensitive files but also exfiltrating critical business data and threatening to publish it on dark web leak sites unless a ransom is paid. The group has demonstrated a unique approach by combining established ransomware techniques with newer strategies, making them quick to adapt to new attack vectors, allowing them to remain a persistent to evolving threat to organizations worldwide.

Tycoon 2FA Phishing Kit Analysis

Cybereason Security Services Team — Mon, 03 Nov 2025 17:42:04 GMT

The Tycoon 2FA phishing kit is a sophisticated Phishing-as-a-Service (PhaaS) platform that emerged in August 2023, designed to bypass two-factor authentication (2FA) and multi-factor authentication (MFA) protections, primarily targeting Microsoft 365 and Gmail accounts. Utilizing an Adversary-in-the-Middle (AiTM) approach, it employs a reverse proxy server to host deceptive phishing pages that mimic legitimate login interfaces, capturing user credentials and session cookies in real-time. According to the Any.run malware trends tracker, Tycoon 2FA leads with over 64,000 reported incidents this year.

From Scripts to Systems: A Comprehensive Look at Tangerine Turkey Operations

Cybereason Security Services Team — Wed, 29 Oct 2025 14:00:35 GMT

In this Threat Analysis report, Cybereason Security Services investigates the flow of a Tangerine Turkey campaign observed in Cybereason EDR. Tangerine Turkey is a threat actor identified as a visual basic script (VBS) worm used to facilitate cryptomining activity.

Cybereason TTP Briefing Q3 2025: LOLBINs and CVE Exploits Dominate

Cybereason Consulting Team — Thu, 23 Oct 2025 12:59:59 GMT

Explore the latest trends, techniques, and procedures (TTPs) our incident response (IR) experts are actively facing with the TTP Briefing Q3 2025, a report built on frontline threat intelligence from our global incident response investigations, enriched by noteworthy detections from our SOC.

Addressing CL0P Extortion Campaign Targeting Oracle EBS CVE-2025-61882

Cybereason Consulting Team — Sun, 05 Oct 2025 01:50:33 GMT

Cybereason is continuing to investigate. Check the Cybereason blog for additional updates.

Last update: Oct 7, 11am EST

Overview and What Cybereason Knows So Far

July 2025, Oracle releases security updates including 309 patches, which included nine that addressed flaws/vulnerabilities in Oracle E-Business Suite (EBS).
July 2025 (end of) through September 2025 (beginning of), Cybereason has assessed based on emerging evidence and ongoing forensic investigations, that CL0P orchestrated an Intrusion Path that allowed for unauthorized access to on-premise, customer-managed Oracle E-Business Suite (EBS) solutions, enumerated accessible and stored data, and conducted data exfiltration.
September 2025 (end of) through October 2025 (beginning of), a widespread orchestrated email extortion campaigns emerged targeting users of on-premise, customer-managed Oracle E-Business Suite (EBS) and requesting contact with CL0P in order to not expose data allegedly exfiltrated.
October 2025 (beginning of), Cybereason is aware of ongoing investigations in which CL0P has provided proof of data. CL0P does not appear to have named new victims associated with this incident as of October 4, 2025.
October 5, 2025, Oracle confirms CVE-2025-61882 in Oracle E-Business Suite (EBS). This vulnerability was remotely exploitable without authentication (i.e., it can be exploited over a network without the need for a username and password). Successful exploitation can lead to remote code execution (RCE).
October 7, 2025, Cybereason confirms earliest evidence of threat actor activity occurred August 9, but is subject to change based on ongoing investigations.