#lorenz

Analysis · May 20, 2026 · Colten Anderson

Lorenz ransomware's way in was the phone system

In 2022, Lorenz ransomware breached corporate networks through a Mitel MiVoice Connect appliance, the VoIP system, using CVE-2022-29499 as a zero-day. Telephony and unified-comms appliances are edge servers running web code, and almost nobody treats them that way.