On-premises deployments of Microsoft SharePoint Server are at the center of a global cyber offensive after multiple zero-day vulnerabilities jointly dubbed “ToolShell” were confirmed to be under active exploitation.
The ToolShell threat chain comprises two newly disclosed vulnerabilities: CVE-2025-53770, a critical remote code execution (RCE) bug, and CVE-2025-53771, a server spoofing flaw.
Both flaws affect SharePoint Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Microsoft SharePoint Online remains unaffected by these exploits.
Exploit Chain
These vulnerabilities have been ruthlessly exploited by an array of threat actors including cybercrime groups and China-linked nation-state advanced persistent threats (APTs) with some attacks chaining previously patched vulnerabilities (CVE-2025-49704, CVE-2025-49706) to bypass authentication mechanisms such as multi-factor authentication (MFA) and single sign-on (SSO).
Once access is gained, attackers typically deploy webshell payloads, like spinstall0.aspx (tracked as MSIL/Webshell.JS), for persistent remote access and data exfiltration.
Additional ASP webshells ghostfile346.aspx, ghostfile399.aspx, ghostfile807.aspx, ghostfile972.aspx, and ghostfile913.aspx have been identified delivering post-exploitation payloads and enabling the execution of arbitrary commands through cmd.exe.
Notably, ESET telemetry recorded the first blocked exploitation attempt in Germany, while successful infections rapidly spread worldwide, with the United States seeing the highest concentration (13.3% of observed attacks).
State-Aligned Groups
Microsoft and third-party telemetry indicate a notable escalation of attacks involving state-sponsored APTs, particularly China-aligned actors such as LuckyMouse.
These groups have targeted government agencies, telecom, and international organizations. In one incident, a LuckyMouse backdoor was found during a ToolShell exploit on a Vietnamese system, underscoring the risk posed to high-value targets and critical infrastructure.
Risk is further elevated due to SharePoint’s integration with other Microsoft services (Teams, OneDrive, Outlook, Office).
According to the report, A successful compromise can allow lateral movement and privileged access across the targeted network.
With patches now available for both CVE-2025-53770 and CVE-2025-53771 as of July 22, all SharePoint administrators are urged to immediately update their on-premises servers to supported and fully patched versions. Additional mitigation steps include:
- Ensuring the Antimalware Scan Interface (AMSI) is enabled and deployed alongside robust security solutions,
- Rotating ASP.NET machine keys post-patch,
- Monitoring for suspicious file and process activity indicative of exploitation or webshell deployment.
With exploitation ongoing and opportunistic attackers joining sophisticated adversaries, unpatched servers remain at high risk of compromise and post-exploitation persistence.
Indicators of Compromise (IoCs)
| IP Address | Hosting Provider | First Seen | Description |
|---|---|---|---|
| 96.9.125[.]147 | BL Networks | 2025-07-17 | SharePoint exploitation activity |
| 107.191.58[.]76 | The Constant Company, LLC | 2025-07-18 | SharePoint exploitation activity |
| 104.238.159[.]149 | The Constant Company, LLC | 2025-07-19 | SharePoint exploitation activity |
| 139.59.11[.]66 | DigitalOcean, LLC | 2025-07-21 | SharePoint exploitation activity |
| 154.223.19[.]106 | Kaopu Cloud HK Limited | 2025-07-21 | SharePoint exploitation activity |
| 103.151.172[.]92 | IKUUU NETWORK LTD | 2025-07-21 | SharePoint exploitation activity |
| 83.136.182[.]237 | Alina Gatsaniuk | 2025-07-21 | SharePoint exploitation activity |
| 162.248.74[.]92 | xTom GmbH | 2025-07-21 | SharePoint exploitation activity |
| 38.54.106[.]11 | Kaopu Cloud HK Limited | 2025-07-21 | SharePoint exploitation activity |
| 206.166.251[.]228 | BL Networks | 2025-07-21 | SharePoint exploitation activity |
| 173.239.247[.]32 | GSL Networks Pty LTD | 2025-07-22 | SharePoint exploitation activity |
| 109.105.193[.]76 | Haruka Network Limited | 2025-07-22 | SharePoint exploitation activity |
| 2.56.190[.]139 | Alina Gatsaniuk | 2025-07-22 | SharePoint exploitation activity |
| 141.164.60[.]10 | The Constant Company, LLC | 2025-07-22 | SharePoint exploitation activity |
| 124.56.42[.]75 | IP Manager | 2025-07-22 | SharePoint exploitation activity |
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates
