Threat and Vulnerabilities Report - April 2025

Summary

As threat actors evolve and refine their techniques, tactics and procedures, April showcased a rapidly escalating threat landscape: one where vulnerabilities are not just active but increasingly weaponized and exploited at an alarming pace. From enterprise software to consumer devices, no platform was spared as exploitation campaigns grew sharper and more opportunistic.  

This month, 15 vulnerabilities were added to the CISA's Known Exploited Vulnerabilities (KEV) catalog, spanning a broad mix of technologies. Key vendors like Microsoft, Apple, and Google each accounted for two vulnerabilities, while SonicWall, Ivanti, CrushFTP and others rounded out the list with one each, revealing how threat actors are casting wide nets across ecosystems.  

Perhaps most alarming, 9 of these vulnerabilities were exploited as zero-days, highlighting a growing gap between vulnerability disclosure and real-world attack.  

Notorious ransomware groups Akira, Play, Qilin, and Lynx, have ramped up their operations, zeroing in on high-value targets in the healthcare and IT manufacturing sectors. These cybercriminals are not just opportunistic; they employ advanced, multi-faceted attack strategies that exploit vulnerabilities to breach defenses, leaving organizations grappling with crippling data loss and operational shutdowns.