Loading story…
Threat actors have increasingly exploited public-facing applications, particularly on-premises Microsoft SharePoint servers, to gain initial access to organizations, with a significant rise in attacks attributed to the ToolShell attack chain. Cisco Talos Incident Response reported that over 60 percent of their recent engagements involved this vector, a sharp increase from the previous quarter, and noted a shift in ransomware activity, with new variants such as Warlock, Babuk, and Kraken observed alongside established families like Qilin and LockBit. The use of open-source DFIR tools like Velociraptor for persistence was also documented, marking a novel tactic in ransomware operations, and some attacks were linked to the China-based group Storm-2603.
Ransomware continues to pose a persistent threat, particularly to public sector organizations, with Trustwave reporting nearly 200 government entities worldwide victimized in 2025 alone. Babuk and Qilin have been identified as the most active ransomware groups targeting the public sector, causing significant operational downtime, service outages, and financial losses. The evolving tactics of ransomware actors and the increasing exploitation of vulnerabilities in public-facing applications underscore the need for robust segmentation and rapid incident response measures across both public and private sectors.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Trustwave reported that ransomware attacks against public sector organizations were still occurring as of its October 2025 publication, indicating an ongoing campaign trend affecting government-related entities. The reference does not provide a specific incident date beyond the publication timeframe.
Cisco Talos reported that ToolShell-related intrusions were the dominant incident response trend in the third quarter of 2025, underscoring the importance of network segmentation and rapid response. This reflects activity occurring during the Q3 2025 period rather than a single isolated incident.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
blog.talosintelligence.com
Open sourcetrustwave.com
Open sourceblog.talosintelligence.com
Open sourceblog.talosintelligence.com
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A significant increase in attacks targeting public-facing applications has been attributed to the exploitation of the ToolShell vulnerability in on-premises Microsoft SharePoint servers. According to Cisco's latest Quarterly Trends report, over 60% of recent Talos Incident Response cases involved attacks on public-facing applications, with nearly 40% specifically linked to ToolShell activity. The surge is tied to two major SharePoint vulnerabilities, CVE-2025-53770 and CVE-2025-53771, which have been actively exploited since mid-July 2025. China-based threat groups Linen Typhoon and Violet Typhoon have been identified as the primary actors behind these campaigns, focusing on sectors such as government, defense, academia, and nonprofits. The majority of incident response engagements related to ToolShell began within ten days of the vulnerabilities' disclosure, underscoring the rapid weaponization and exploitation by threat actors. Security experts warn that unpatched SharePoint servers present a critical risk, enabling attackers to move laterally within networks and potentially deploy ransomware. Cisco emphasizes the importance of robust network segmentation and timely patching to mitigate these threats. The exploitation of ToolShell highlights the ongoing challenges organizations face in defending public-facing applications and the need for proactive vulnerability management to prevent large-scale compromise and operational disruption.
Jun 29, 2026
Government organizations worldwide are facing escalating cyber threats, with ransomware and extortion attacks sharply increasing in frequency and sophistication. Over 117 US federal and state entities were impacted in 2024, and attackers are increasingly targeting third-party providers and leveraging new tactics such as data extortion without encryption. The MOVEit and GoAnywhere supply chain breaches have had lasting repercussions, exposing sensitive data from government-linked organizations. Attackers are also employing advanced techniques, including the use of AI for phishing and deepfakes for social engineering, further complicating defense efforts. International coalitions, such as the Counter Ransomware Initiative (CRI), are urging stronger supply-chain cyber defenses and coordinated global action, highlighting the immediate and urgent threat ransomware poses to national security and economic stability. Despite some progress in reducing ransomware payments, attacks continue to disrupt major companies and public sector entities worldwide. The CRI, now comprising 61 countries and six international organizations, has released new guidance emphasizing the need for improved cyber hygiene and legislative action to address supply-chain vulnerabilities. Critics warn that legislative gaps persist, leaving critical systems exposed, while the ongoing digital transformation and prevalence of legacy systems in the public sector further increase risk. The convergence of these factors underscores the urgent need for comprehensive cybersecurity strategies and international cooperation to bolster resilience against evolving threats.
Jun 29, 2026
Sophos reported that the ransomware group **Warlock Group**, tracked as **GOLD SALEM**, has been compromising enterprise networks and deploying **Warlock ransomware** since March 2025, with 60 publicly named victims through mid-September across North America, Europe, and South America. The operation used a Tor-based leak site, activity on underground forums, and possibly relationships with initial access brokers to support intrusions and extortion. Observed attacks began with exploitation of the **SharePoint ToolShell** exploit chain, followed by deployment of an **ASPX web shell** and a Golang-based WebSockets backdoor for persistence. Sophos said the actors stole credentials with **Mimikatz**, moved laterally with **PsExec** and **Impacket**, deployed ransomware through **Group Policy Objects**, and disabled endpoint protection using a **bring-your-own-vulnerable-driver** technique involving a vulnerable **Baidu Antivirus** driver; investigators also observed abuse of **Velociraptor** to establish a **Visual Studio Code** network tunnel. Microsoft tracks the activity as **Storm-2603** and assesses it with moderate confidence as China-based, though Sophos said it could not independently confirm that attribution.
Jun 29, 2026