Outbreak Alert: Interlock Ransomware Attack
| FortiRecon Digital Risk Protection (DRP), a SaaS-based service, includes External Attack Surface Management, Brand Protection, and Adversary Centric Intelligence. Adversary Centric Intelligence (ACI): leverages FortiGuard Threat Analysis to provide comprehensive coverage of dark web, open-source, and technical threat intelligence, including threat actor insights to enable organizations to respond proactively assess risks, respond faster to incidents, better understand their attackers, and guard assets. The Vulnerability Intelligence Module under Adversary Centric Intelligence (ACI) provides a realistic view of the impact of the vulnerability based upon chatter and discussion of the same across various external sources such as Darkweb, social media, News / Blogs etc. | |
| Adversary Name | Interlock ransomware group, Interlock Ransomware, Interlock ransomware operators, Interlock Ransomware Operators, Interlock Ransomware Operator, Interlock ransomware Operators |
| Exploited Vulnerabilities |
|
| ACI Reporting Coverage | 12 (Technical Intelligence), 1 (OSINT) |
| Addition Reference |
|
| CVE ID | CVE-2025-8876 |
| CVE Title | N-able N-Central Command Injection Vulnerability |
| NVD Severity | HIGH |
| FortiRecon Severity | HIGH |
| FortiRecon Score | 78/100 |
| Epss Score | 0.07848 |
| Exploited | Yes |
| Exploited by Ransomware Group(s) | Yes (RomCom) |
| Exploited by APT Group(s) | No |
| Included in CISA KEV List | Yes |
| Available working exploit(s) | 0 |
| Available POC exploit(s) | 1 |
| Darknet Mention(s) | 1 (underc0de) |
| Telegram Mention(s) | 0 |
| FortiRecon Intelligence Reporting(s) | 8 (OSINT), 1 (Technical Intelligence), 3 (FortiGuard Research) |
| Vendor Advisory: |
| CVE ID | CVE-2025-8875 |
| CVE Title | N-able N-Central Insecure Deserialization Vulnerability |
| NVD Severity | HIGH |
| FortiRecon Severity | HIGH |
| FortiRecon Score | 78/100 |
| Epss Score | 0.02608 |
| Exploited | Yes |
| Exploited by Ransomware Group(s) | Yes (RomCom) |
| Exploited by APT Group(s) | No |
| Included in CISA KEV List | Yes |
| Available working exploit(s) | 0 |
| Available POC exploit(s) | 1 |
| Darknet Mention(s) | 1 (underc0de) |
| Telegram Mention(s) | 0 |
| FortiRecon Intelligence Reporting(s) | 8 (OSINT), 1 (Technical Intelligence), 3 (FortiGuard Research) |
| Vendor Advisory: |
| CVE ID | CVE-2025-8671 |
| CVE Title | A mismatch caused by client-triggered server-sent stream resets between HTTP/2... |
| NVD Severity | HIGH |
| FortiRecon Severity | LOW |
| FortiRecon Score | 23/100 |
| Epss Score | 0.00538 |
| Exploited | No |
| Exploited by Ransomware Group(s) | Yes (RomCom) |
| Exploited by APT Group(s) | No |
| Included in CISA KEV List | No |
| Available working exploit(s) | 0 |
| Available POC exploit(s) | 4 |
| Darknet Mention(s) | 0 |
| Telegram Mention(s) | 0 |
| FortiRecon Intelligence Reporting(s) | 4 (OSINT) |
| Vendor Advisory: |
| CVE ID | CVE-2025-8088 |
| CVE Title | RARLAB WinRAR Path Traversal Vulnerability |
| NVD Severity | HIGH |
| FortiRecon Severity | CRITICAL |
| FortiRecon Score | 95/100 |
| Epss Score | 0.0795 |
| Exploited | Yes |
| Exploited by Ransomware Group(s) | Yes (RomCom) |
| Exploited by APT Group(s) | Yes (APT-C-53, Bitter APT Group, UNC4895, Lazarus, Autumn Dragon, RomCom, Gamaredon Group, Amaranth-Dragon, Earth Estries, UNC2970, Amaranth Dragon) |
| Included in CISA KEV List | Yes |
| Available working exploit(s) | 0 |
| Available POC exploit(s) | 30 |
| Darknet Mention(s) | 10 (exploit, sinister, xss, underc0de, damagelib) |
| Telegram Mention(s) | 1 (DragonForce Malaysia) |
| FortiRecon Intelligence Reporting(s) | 10 (Technical Intelligence), 16 (OSINT), 1 (Darknet), 15 (FortiGuard Research) |
| Vendor Advisory: |
| CVE ID | CVE-2025-53786 |
| CVE Title | On April 18th 2025, Microsoft announced Exchange Server Security Changes... |
| NVD Severity | HIGH |
| FortiRecon Severity | LOW |
| FortiRecon Score | 23/100 |
| Epss Score | 0.00109 |
| Exploited | No |
| Exploited by Ransomware Group(s) | Yes (RomCom) |
| Exploited by APT Group(s) | No |
| Included in CISA KEV List | No |
| Available working exploit(s) | 0 |
| Available POC exploit(s) | 1 |
| Darknet Mention(s) | 0 |
| Telegram Mention(s) | 0 |
| FortiRecon Intelligence Reporting(s) | 13 (OSINT), 1 (FortiGuard Research) |
| Vendor Advisory: |
| CVE ID | CVE-2025-53779 |
| CVE Title | Relative path traversal in Windows Kerberos allows an authorized attacker... |
| NVD Severity | HIGH |
| FortiRecon Severity | LOW |
| FortiRecon Score | 26/100 |
| Epss Score | 0.00453 |
| Exploited | No |
| Exploited by Ransomware Group(s) | Yes (RomCom) |
| Exploited by APT Group(s) | No |
| Included in CISA KEV List | No |
| Available working exploit(s) | 0 |
| Available POC exploit(s) | 1 |
| Darknet Mention(s) | 3 (exploit) |
| Telegram Mention(s) | 0 |
| FortiRecon Intelligence Reporting(s) | 14 (OSINT), 1 (Darknet), 2 (FortiGuard Research) |
| Vendor Advisory: |
| CVE ID | CVE-2025-53766 |
| CVE Title | Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker... |
| NVD Severity | CRITICAL |
| FortiRecon Severity | LOW |
| FortiRecon Score | 23/100 |
| Epss Score | 0.00449 |
| Exploited | No |
| Exploited by Ransomware Group(s) | Yes (RomCom) |
| Exploited by APT Group(s) | No |
| Included in CISA KEV List | No |
| Available working exploit(s) | 0 |
| Available POC exploit(s) | 2 |
| Darknet Mention(s) | 0 |
| Telegram Mention(s) | 0 |
| FortiRecon Intelligence Reporting(s) | 9 (OSINT) |
| Vendor Advisory: |
| CVE ID | CVE-2025-50165 |
| CVE Title | Untrusted pointer dereference in Microsoft Graphics Component allows an unauthorized... |
| NVD Severity | CRITICAL |
| FortiRecon Severity | LOW |
| FortiRecon Score | 29/100 |
| Epss Score | 0.03877 |
| Exploited | No |
| Exploited by Ransomware Group(s) | Yes (RomCom) |
| Exploited by APT Group(s) | No |
| Included in CISA KEV List | No |
| Available working exploit(s) | 0 |
| Available POC exploit(s) | 1 |
| Darknet Mention(s) | 0 |
| Telegram Mention(s) | 0 |
| FortiRecon Intelligence Reporting(s) | 9 (OSINT) |
| Vendor Advisory: |
| CVE ID | CVE-2025-49712 |
| CVE Title | Deserialization of untrusted data in Microsoft Office SharePoint allows an... |
| NVD Severity | HIGH |
| FortiRecon Severity | LOW |
| FortiRecon Score | 21/100 |
| Epss Score | 0.05642 |
| Exploited | No |
| Exploited by Ransomware Group(s) | Yes (RomCom) |
| Exploited by APT Group(s) | No |
| Included in CISA KEV List | No |
| Available working exploit(s) | 0 |
| Available POC exploit(s) | 0 |
| Darknet Mention(s) | 0 |
| Telegram Mention(s) | 0 |
| FortiRecon Intelligence Reporting(s) | 5 (OSINT) |
| Vendor Advisory: |
| CVE ID | CVE-2025-32433 |
| CVE Title | Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability |
| NVD Severity | CRITICAL |
| FortiRecon Severity | CRITICAL |
| FortiRecon Score | 91/100 |
| Epss Score | 0.50314 |
| Exploited | Yes |
| Exploited by Ransomware Group(s) | Yes (RomCom) |
| Exploited by APT Group(s) | No |
| Included in CISA KEV List | Yes |
| Available working exploit(s) | 0 |
| Available POC exploit(s) | 42 |
| Darknet Mention(s) | 12 (xss, ramp, exploit) |
| Telegram Mention(s) | 2 (Системный Администратор (Сисадмин), Proxy Bar) |
| FortiRecon Intelligence Reporting(s) | 3 (Darknet), 7 (FortiGuard Research), 14 (OSINT) |
| Vendor Advisory: |
| CVE ID | CVE-2025-26633 |
| CVE Title | Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability |
| NVD Severity | HIGH |
| FortiRecon Severity | HIGH |
| FortiRecon Score | 78/100 |
| Epss Score | 0.07822 |
| Exploited | Yes |
| Exploited by Ransomware Group(s) | Yes (EncryptHub, RomCom) |
| Exploited by APT Group(s) | Yes (Water Gamayun) |
| Included in CISA KEV List | Yes |
| Available working exploit(s) | 0 |
| Available POC exploit(s) | 2 |
| Darknet Mention(s) | 2 (bdf, crdclub) |
| Telegram Mention(s) | 0 |
| FortiRecon Intelligence Reporting(s) | 9 (OSINT), 4 (Technical Intelligence), 2 (Darknet), 13 (FortiGuard Research) |
| Vendor Advisory: |
| CVE ID | CVE-2025-25256 |
| CVE Title | An improper neutralization of special elements used in an OS... |
| NVD Severity | CRITICAL |
| FortiRecon Severity | HIGH |
| FortiRecon Score | 78/100 |
| Epss Score | 0.44919 |
| Exploited | Yes |
| Exploited by Ransomware Group(s) | Yes (RomCom) |
| Exploited by APT Group(s) | No |
| Included in CISA KEV List | No |
| Available working exploit(s) | 0 |
| Available POC exploit(s) | 1 |
| Darknet Mention(s) | 1 (underc0de) |
| Telegram Mention(s) | 0 |
| FortiRecon Intelligence Reporting(s) | 11 (OSINT), 1 (Technical Intelligence), 5 (FortiGuard Research) |
| Vendor Advisory: |
| CVE ID | CVE-2025-20265 |
| CVE Title | A vulnerability in the RADIUS subsystem implementation of Cisco Secure... |
| NVD Severity | CRITICAL |
| FortiRecon Severity | LOW |
| FortiRecon Score | 26/100 |
| Epss Score | 0.00225 |
| Exploited | No |
| Exploited by Ransomware Group(s) | Yes (RomCom) |
| Exploited by APT Group(s) | No |
| Included in CISA KEV List | No |
| Available working exploit(s) | 0 |
| Available POC exploit(s) | 3 |
| Darknet Mention(s) | 3 (duty_free, alphv, underc0de) |
| Telegram Mention(s) | 1 (Proxy Bar) |
| FortiRecon Intelligence Reporting(s) | 6 (OSINT) |
| Vendor Advisory: |