ThreatCluster
About Blog Help Contact
Login
  • Feed
  • Dashboard
  • Saved
THREAT HUNTING
  • Domains
  • IP Addresses
  • File Hashes
  • CVEs
THREAT INTELLIGENCE
  • APT Groups
  • Ransomware Groups
  • Malware Families
  • Attack Types
  • MITRE ATT&CK
  • Security Standards
  • Vulnerability Types
BUSINESS INTELLIGENCE
  • Companies
  • Industry Sectors
  • Security Vendors
  • Government Agencies
  • Countries
  • Platforms
Home / Feed / Article

Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks

Threat Score:
50
Palo Alto Unit 42
4 days ago
Part of cluster #1713
Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks

Overview

Threat Research Center Threat Research Vulnerabilities Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks By:Hiroaki HaraMark Lim Hiroaki Hara Mark Lim Published:August 5, 2025 Categories:Threat ResearchVulnerabilities Threat Research Vulnerabilities Tags:BackdoorCL-CRI-1040CVE-2025-49704CVE-2025-49706CVE-2025-53770CVE-2025-53771LockBitMicrosoftSharePointStorm-2603 Backdoor CL-CRI-1040 CVE-2025-49704 CVE-2025-49706 CVE-2025-53770 CVE-2025-53771 LockBit Microsoft SharePoint S...

Continue Reading on Original Site

Related Articles

5 articles
1
Stop Reacting; Start Anticipating: The Global State of Threat Intelligence

Stop Reacting; Start Anticipating: The Global State of Threat Intelligence

Brighttalk • 9 hours ago

Presented by Jitin Shabadu, Forrester Analyst | Jayce Nichols, Director, Intelligence Solutions, Google Threat Intelligence Group

Score
83
Read more
2

Linux-Based Lenovo Webcams’ Flaw Can Be Remotely Exploited for BadUSB Attacks

The Hacker News • 5 hours ago

Cybersecurity researchers have disclosed vulnerabilities in select model webcams from Lenovo that could turn them into BadUSB attack devices. "This allows remote attackers to inject keystrokes covertly and launch attacks independent of the host operating system," Eclypsium researchers Paul Asadoorian, Mickey Shkatov, and Jesse Michaelsaidin a report shared with The Hacker News. The vulnerabilities have been codenamed BadCam by the firmware security company. The findings werepresentedat the DEF C

Score
75
Read more
3

Embargo Ransomware nets $34.2M in crypto since April 2024

Security Affairs • 6 hours ago

Embargo ransomware, likely a BlackCat/Alphv successor, has netted $34.2M in crypto since mid-2024, researchers say. The Embargo ransomware group has processed $34.2M in crypto since emerging in April 2024, researchers from Blockchain intelligence company TRM Labs report. “TRM Labs has identified approximately USD 34.2 million in incoming transaction volume likely associated with the group, with […]

Score
75
Read more
4

WinRAR Zero-Day CVE-2025-8088 Exploited to Spread RomCom Malware

Hackread • 9 hours ago

Critical WinRAR flaw CVE-2025-8088 exploited by Russia-linked hackers to spread RomCom malware, update to version 7.13 now to…

Score
75
Read more
5
Google confirms data breach exposed potential Google Ads customers' info

Google confirms data breach exposed potential Google Ads customers' info

BleepingComputer • 4 hours ago

Google confirms data breach exposed potential Google Ads customers' info Lawrence Abrams August 9, 2025 03:15 PM 0 Google has confirmed that arecently disclosed data breachof one of its Salesforce CRM instances involved the information of potential Google Ads customers. "We're writing to let you know an event that affected a limited set of data in one of Google's corporate Salesforce instances used to communicate with prospective Ads customers," reads a data breach notification shared with Bleep

Score
74
Read more

Save to Folder

Choose a folder to save this article:

Article Intelligence

Key entities and indicators for this article

CVES
CVE-2025-49704
CVE-2025-49706
CVE-2025-53770
CVE-2025-53771
FILE PATH
C:\Users\Administrator\Desktop\work\tools\ai\ak47\cpp\encrypt\encrypt\x64\Release\encrypt.pdb
C:\Users\Administrator\Desktop\work\tools\ak47c2\dnsclinet-c\dnsclient\x64\Release\dnsclient.pdb
C:\Users\Administrator\Desktop\work\tools\ak47c2\httpclient-cpp\x64\Release\httpclient-cpp.pdb
ATTACK TYPES
Command and Control
Data Exfiltration
Exploit
Exploitation of Public-Facing Applications
Phishing
COUNTRIES
China
COMPANIES
CISA
Microsoft
Palo Alto Networks
SECURITY VENDORS
CrowdStrike
Palo Alto Networks
Unit 42
PLATFORMS
Microsoft SharePoint
SharePoint
RANSOMWARE
4L4MD4R
Desktop
EnCrypt
First
LockBit
MALWARE
4L4MD4R
AK47 ransomware
Nexus
Project AK47
WildFire
APT GROUPS
Linen Typhoon
Storm-2603
Violet Typhoon
MITRE ATT&CK
T1047
T1053
T1059
T1059.001
T1070.001
VULNERABILITIES
Data Encryption for Impact
Remote Code Execution
DOMAINS
innovationfactory.it
IP ADDRESSES
145.239.97.206
INDUSTRIES
Cybersecurity
Finance
Government
Information Technology
Technology
AGENCIES
Department of Homeland Security
National Nuclear Security Administration
IP ADDRESSES
145.239.97.206
DOMAINS
innovationfactory.it
ARTICLE INFORMATION
Article #9013
Published 4 days ago
Palo Alto Unit 42

We use cookies

We use cookies and similar technologies to enhance your experience, analyse site usage, and assist in our marketing efforts.

Cookie Settings

Essential Cookies

Required for the website to function. Cannot be disabled.

  • Session management and authentication
  • Security and fraud prevention
  • Cookie consent preferences

Analytics Cookies

Help us understand how visitors interact with our website.

  • Plausible Analytics - Privacy-focused usage statistics
  • PostHog - Product analytics and feature tracking
  • Page views and user journey analysis

Performance Cookies

Help us monitor and improve website performance.

  • Page load time monitoring
  • Error tracking and debugging
  • Performance optimisation

Marketing Cookies

Used to track visitors across websites for marketing purposes.

  • Conversion tracking
  • Remarketing campaigns
  • Social media integration