216.73.216.6

Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks

· Published 06/08/2025 08:15 · Modified 06/08/2025 09:06

Export JSON

Essential information

Published
06/08/2025 08:15
Modified
06/08/2025 09:06
Tags
2025-08-06 CVE-2025-49704 CVE-2025-49706 CVE-2025-53770 CVE-2025-53771 ak47 ransomware ak47c2 backdoor lockbit lockbit 3.0 project ak47 ransomware sharepoint toolshell warlock warlock client x2anylock
Related entities
11 vulnerabilities (cve), 27 observables, 1 intrusion sets (apt), 19 techniques (mitre), 5 malware

Description

Unit 42 has identified significant overlaps between Microsoft's reported activity and a threat cluster they track as CL-CRI-1040. This cluster utilizes a tool set called , which includes a multi-protocol , custom , and loaders. The activity is linked to the exploitation of recent vulnerabilities and is believed to be financially motivated. CL-CRI-1040 was previously associated with and is now connected to a double-extortion site called . The analysis reveals a complex threat landscape with potential ties to both cybercriminal and nation-state actors.

Related entities

Vulnerabilities, IOCs, intrusion sets, MITRE techniques and other entities referenced in this report.

External references