How a noisy ransomware intrusion exposed a long-term espionage foothold

Threat researchers at Positive Technologies have detailed two incidents at Russian companies, tying them to QuietCrabs, a threat actor believed to be of Asian origin and focused on cyber espionage, and to Thor, a group that has targeted Russian firms with LockBit and Babuk ransomware. Both groups exploited publicly known vulnerabilities in Microsoft SharePoint Server (CVE-2025-53770) and Ivanti’s solutions (CVE-2024-21887, CVE-2025-4427, CVE-2025-4428, CVE-2023-38035) to achieve initial access.

The report describes these as a “double whammy” that exposed a long-term espionage foothold, with the noisier intrusion potentially drawing attention to a more stealthy threat that might linger undetected for months. The account, as cited by Help Net Security, notes that the incidents involved two separate and likely unconnected groups exploiting these vulnerabilities to gain entry.

According to Help Net Security, the findings underscore how public-vulnerability exploitation can enable both ransomware activity and prolonged espionage.