Loading story…
MBSD-SOC reported active exploitation attempts against on-premises Microsoft SharePoint Server flaws CVE-2025-53770 and CVE-2025-53771, vulnerabilities disclosed on 2025-07-19 that can enable authentication bypass and arbitrary code execution. The activity was first observed by the SOC on 2025-07-22 and affected SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Observed requests included a Referer header pointing to /_layouts/SignOut.aspx, indicating an apparent attempt to bypass authentication before further compromise.
The report said attackers are also chaining CVE-2025-49704 and CVE-2025-49706 with the newer SharePoint flaws in an attack path referred to as ToolShell, allowing unauthenticated compromise and control of vulnerable SharePoint servers. MBSD-SOC said many attack sources were traced to the United States, followed by Japan, France, Germany, and Hong Kong, and urged organizations to apply Microsoft security updates immediately to reduce exposure to internet-facing SharePoint systems.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft released security updates for SharePoint Server 2016 on 22 July 2025, following updates for SharePoint Server Subscription Edition and SharePoint Server 2019, to address the actively exploited CVE-2025-53770 vulnerability.
MBSD-SOC reported first seeing attack traffic targeting CVE-2025-53770 and CVE-2025-53771, including requests to SharePoint ToolPane paths and use of the Referer header '/_layouts/SignOut.aspx' in an apparent authentication-bypass attempt.
MBSD-SOC states that the Microsoft SharePoint vulnerabilities CVE-2025-53770 and CVE-2025-53771 were publicly disclosed, affecting on-premises SharePoint Server deployments and enabling authentication bypass and possible remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
6 references tracked. Mallory keeps watching after this page renders.
mbsd.jp
Open sourcencsc.nl
Open sourcemsrc.microsoft.com
Open sourcecve.mitre.org
Open sourcecve.mitre.org
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A significant increase in attacks targeting public-facing applications has been attributed to the exploitation of the ToolShell vulnerability in on-premises Microsoft SharePoint servers. According to Cisco's latest Quarterly Trends report, over 60% of recent Talos Incident Response cases involved attacks on public-facing applications, with nearly 40% specifically linked to ToolShell activity. The surge is tied to two major SharePoint vulnerabilities, CVE-2025-53770 and CVE-2025-53771, which have been actively exploited since mid-July 2025. China-based threat groups Linen Typhoon and Violet Typhoon have been identified as the primary actors behind these campaigns, focusing on sectors such as government, defense, academia, and nonprofits. The majority of incident response engagements related to ToolShell began within ten days of the vulnerabilities' disclosure, underscoring the rapid weaponization and exploitation by threat actors. Security experts warn that unpatched SharePoint servers present a critical risk, enabling attackers to move laterally within networks and potentially deploy ransomware. Cisco emphasizes the importance of robust network segmentation and timely patching to mitigate these threats. The exploitation of ToolShell highlights the ongoing challenges organizations face in defending public-facing applications and the need for proactive vulnerability management to prevent large-scale compromise and operational disruption.
Jun 29, 2026
Hackers believed to be associated with China have exploited the ToolShell vulnerability (CVE-2025-53770) in Microsoft SharePoint, targeting a broad range of organizations across multiple continents. The vulnerability, which affects on-premise SharePoint servers, was disclosed as an actively exploited zero-day on July 20, 2025, prompting Microsoft to release emergency patches the following day. The flaw is a bypass for previously reported vulnerabilities (CVE-2025-49706 and CVE-2025-49704) and allows remote, unauthenticated attackers to execute code and gain full access to the file system. Multiple Chinese threat groups, including Budworm/Linen Typhoon, Sheathminer/Violet Typhoon, and Storm-2603/Warlock ransomware, have been linked to these attacks. Symantec reported that the ToolShell exploit was used to compromise organizations in the Middle East, South America, the United States, Africa, and Europe, with targets including government agencies, universities, telecommunications providers, and financial institutions. In one case, attackers exploited the vulnerability to plant webshells for persistent access, followed by the deployment of a Go-based backdoor named Zingdoor and the ShadowPad Trojan, both of which facilitate remote command execution and data exfiltration. Storm-2603, a financially motivated group, was observed deploying ransomware such as LockBit Black and WarLock/X2anylock by exploiting the same set of SharePoint vulnerabilities, with major activity noted on July 18, 2025. Their operations targeted organizations in Latin America and the APAC region, using a combination of public-facing application exploits and legitimate tools like PsExec for lateral movement and execution. The attacks highlight the critical risk posed by unpatched SharePoint servers, as attackers were able to gain initial access, establish persistence, and deploy sophisticated malware and ransomware payloads. The campaigns demonstrate a high level of coordination and technical capability, leveraging zero-day exploits and advanced post-exploitation techniques. The breach of the National Nuclear Security Administration’s Kansas City National Security Campus further underscores the severity of these attacks, as foreign actors exploited the same SharePoint vulnerabilities to infiltrate a facility responsible for manufacturing critical components for US nuclear weapons. The incident at the Kansas City plant raised significant concerns about the security of federal IT and OT systems, especially those supporting national security functions. Despite the high-profile nature of the targets, responses from affected organizations and government agencies have been limited, with some declining to comment on the incidents. The rapid release of patches by Microsoft and the subsequent widespread exploitation illustrate the importance of timely vulnerability management and the need for robust security controls around public-facing applications. Security researchers have emphasized the necessity for organizations to validate their defenses against these specific TTPs and to continuously monitor for signs of compromise related to the ToolShell exploit. The attacks serve as a stark reminder of the persistent threat posed by state-linked actors and the critical importance of securing enterprise collaboration platforms like SharePoint.
Jun 29, 2026
Microsoft disclosed multiple on-premises SharePoint Server vulnerabilities, including remote code execution flaws `CVE-2025-49701` and `CVE-2025-49704` and spoofing flaw `CVE-2025-49706`, as defenders responded to active exploitation. Microsoft said it was working to disrupt attacks targeting exposed SharePoint environments, while the Canadian Centre for Cyber Security issued threat-detection guidance to help organizations identify compromise tied to the SharePoint vulnerabilities. Subsequent reporting tied the broader **ToolShell** exploitation chain, including `CVE-2025-53770`, to China-linked operators that breached a Middle Eastern telecom provider, government departments in Africa, government agencies in South America, and a U.S. university. Investigators said the intrusions used malware and tooling including **Zingdoor**, **ShadowPad**, **KrustyLoader**, and **Sliver**, alongside credential-dumping, proxying, DLL sideloading, and persistence techniques, indicating a stealthy espionage-focused campaign that expanded beyond initial public understanding of the SharePoint attacks.
Jun 29, 2026