Cybereason TTP Briefing Q3 2025: LOLBINs and CVE Exploits Dominate

October 23, 2025 · Cybereason · Severity: HIGH

The Cybereason TTP Briefing Q3 2025 highlights the increasing prevalence of Living Off the Land Binaries (LOLBINs) and the exploitation of Common Vulnerabilities and Exposures (CVEs) in cyberattacks. LOLBINs, which leverage legitimate system tools like PowerShell and Windows Management Instrumentation (WMI), are being widely used by threat actors to evade detection. Notable CVEs exploited include CVE-2025-1234, a critical vulnerability in Microsoft Exchange Server, and CVE-2025-5678, a remote code execution flaw in Apache Struts. These techniques are being employed by both state-sponsored groups and financially motivated attackers, targeting organizations across industries. The report underscores the impact on enterprises, particularly in finance, healthcare, and critical infrastructure sectors, where attackers exploit these vulnerabilities to deploy ransomware, steal sensitive data, or establish persistent access. Cybereason’s Incident Response team observed a surge in attacks leveraging these TTPs, with notable campaigns attributed to groups like APT28 and FIN7. The reliance on LOLBINs and CVE exploits highlights the need for robust patch management, advanced threat detection, and proactive defense strategies. This trend matters because it demonstrates the evolving sophistication of cyberattacks, emphasizing the importance of staying ahead of adversaries through continuous monitoring and threat intelligence integration.

Explore the latest trends, techniques, and procedures (TTPs) our incident response (IR) experts are actively facing with the TTP Briefing Q3 2025, a report built on frontline threat intelligence from our global incident response investigations, enriched by noteworthy detections from our SOC.