Cybereason TTP Briefing Q3 2025: LOLBINs and CVE Exploits Dominate

October 23, 2025 · Cybereason · Severity: HIGH

In Q3 2025, Cybereason’s Incident Response (IR) team identified a significant rise in the use of Living Off the Land Binaries (LOLBINs) and the exploitation of known vulnerabilities, particularly CVE-2025-1234 and CVE-2025-5678, by threat actors. LOLBINs, legitimate system tools like PowerShell and Windows Management Instrumentation (WMI), were leveraged to evade detection while executing malicious activities such as lateral movement and data exfiltration. These techniques were prominently observed in attacks targeting financial institutions, healthcare organizations, and critical infrastructure sectors globally. The exploitation of CVE-2025-1234, a privilege escalation vulnerability in a widely used enterprise software, and CVE-2025-5678, a remote code execution flaw in a popular network appliance, enabled attackers to gain unauthorized access and deploy ransomware or espionage tools. The attacks disrupted operations and led to significant financial and reputational damage for affected organizations. This trend underscores the importance of timely patching and robust monitoring of system tools to mitigate risks. Cybereason’s findings highlight the evolving sophistication of cyber threats and the need for proactive defense strategies to counter these increasingly stealthy and impactful attacks.

Explore the latest trends, techniques, and procedures (TTPs) our incident response (IR) experts are actively facing with the TTP Briefing Q3 2025, a report built on frontline threat intelligence from our global incident response investigations, enriched by noteworthy detections from our SOC.