Trellix SecondSight Threat Hunting Report, Feb 2026
trellix.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
1 CVE- CVE-2025-53770Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityMicrosoft · SharePointKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter2 reports>99.9%Top 0.01%86.0priority
Where it names them
CVE-2025-53770 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2025-53770.
CVE-2025-53770 & COBALT STRIKE C2 INFRASTRUCTURE
(CVE-2025-53770) targeting financial, healthcare, and life science
The immediate, high-severity threat posed by the easily exploitable CVE- 2025-53770 vulnerability prompted our team to proactively investigate its
Organizations should immediately patch CVE-2025-53770 and rotate
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.