Threats & Adversaries · Phishing / BEC

Voice Phishing Drives 11% of Intrusions in 2025

Mandiant reported multiple large intrusions in 2025 driven by phone-based social engineering. Groups tied to The Com and Scattered Spider used voice phishing against Salesforce customers; email phishing declined as exploited vulnerabilities remained the top initial access vector.

2 sources · Mar 24

CVE-2025-53770

NVD KEV

Known exploited · CISA KEV

CVSS 9.8 CRITICAL: deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to… Known ransomware campaign use. EPSS 100% (100th percentile).

CISA federal remediation date Jul 21 · date passed

CVE-2025-61882

NVD KEV

Known exploited · CISA KEV

CVSS 9.8 CRITICAL: vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Known ransomware campaign use. EPSS 100% (100th percentile).

CISA federal remediation date Oct 27 · date passed

CVE-2025-31324

NVD KEV

Known exploited · CISA KEV

CVSS 10 CRITICAL: sAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing… Known ransomware campaign use. EPSS 100% (100th percentile).

CISA federal remediation date May 20 · date passed

Timeline

Mar 24 Reported by Cybersecurity Dive
Mar 23 Reported by CyberScoop
Oct 27 CISA federal deadline for CVE-2025-61882 passed
Oct 6 CVE-2025-61882 added to CISA KEV
Jul 21 CISA federal deadline for CVE-2025-53770 passed
Jul 20 CVE-2025-53770 added to CISA KEV
May 20 CISA federal deadline for CVE-2025-31324 passed
Apr 29 CVE-2025-31324 added to CISA KEV

Sources

Mar 24 Cybersecurity Dive
Cybercrime groups speed up initial access handoff through planning, coordination
A report by Google Threat Intelligence Group also shows voice-based phishing has surged amid a rise in social engineering tactics.
original
Mar 23 CyberScoop
The phone call is the new phishing email
Voice-based phishing was at the root of multiple attack sprees Mandiant responded to last year, reflecting a concerning shift in tactics.
original

Vendor digest: Microsoft

Part of the PlainSec briefing for 2026-03-24

Every edition of this story: Voice Phishing Drives 11% of Intrusions in 2025

More from today

Iran-Related Cyber Campaigns Spike with Wipers and Ransomware

Threats & Adversaries · Phishing / BECVoice Phishing Drives 11% of Intrusions in 2025Mandiant reported multiple large intrusions in 2025 driven by phone-based social engineering. Groups tied to The Com and Scattered Spider used voice phishing against Salesforce customers; email phishing declined as exploited vulnerabilities remained the top initial access vector.2 sources · Mar 24

CVE-2025-53770

NVD KEV

Known exploited · CISA KEV

CVSS 9.8 CRITICAL: deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to… Known ransomware campaign use. EPSS 100% (100th percentile).

CISA federal remediation date Jul 21 · date passed

CVE-2025-61882

NVD KEV

Known exploited · CISA KEV

CISA federal remediation date Oct 27 · date passed

CVE-2025-31324

NVD KEV

Known exploited · CISA KEV

CVSS 10 CRITICAL: sAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing… Known ransomware campaign use. EPSS 100% (100th percentile).

CISA federal remediation date May 20 · date passed

Timeline

Mar 24 Reported by Cybersecurity Dive

Mar 23 Reported by CyberScoop

Oct 27 CISA federal deadline for CVE-2025-61882 passed

Oct 6 CVE-2025-61882 added to CISA KEV

Jul 21 CISA federal deadline for CVE-2025-53770 passed

Jul 20 CVE-2025-53770 added to CISA KEV

May 20 CISA federal deadline for CVE-2025-31324 passed

Apr 29 CVE-2025-31324 added to CISA KEV

Sources

Mar 24 Cybersecurity Dive

Cybercrime groups speed up initial access handoff through planning, coordination

A report by Google Threat Intelligence Group also shows voice-based phishing has surged amid a rise in social engineering tactics.

original

Mar 23 CyberScoop

The phone call is the new phishing email

Voice-based phishing was at the root of multiple attack sprees Mandiant responded to last year, reflecting a concerning shift in tactics.

original

Vendor digest: MicrosoftPart of the PlainSec briefing for 2026-03-24Every edition of this story: Voice Phishing Drives 11% of Intrusions in 2025More from today