Threat Actors Ramp Up Public App Exploits as ToolShell Gains Traction
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-53770 | Unauthenticated Deserialization RCE in Microsoft SharePoint Server on-premises CVE-2025-53770 is a deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint Server on-premises that allows an unauthorized attacker to execute code over a network. It is triggered when the server deserializes attacker-controlled data, can be chained with CVE-2025-53771, and it bypasses the fixes issued for CVE-2025-49704, meaning the earlier patches are insufficient. Successful exploitation yields remote code execution on the SharePoint server, and ransomware operators are known to be using it. Any organization running SharePoint Server on-premises is affected, particularly internet-facing deployments and end-of-life versions such as SharePoint Server 2013 and earlier that can no longer be patched. The flaw is being actively exploited — it was added to CISA's KEV on 2025-07-20 with known ransomware use — and EPSS assigns it a 100% probability of exploitation within 30 days. Do: Apply Microsoft's updated SharePoint Server security updates that fix CVE-2025-53770 — these include more robust protection than the earlier CVE-2025-49704 updates — and ensure the companion CVE-2025-53771 is also addressed, following CISA and vendor mitigation instructions for supported versions. Disconnect public-facing SharePoint Server 2013 or earlier (EOL/EOS) instances, minimize internet exposure of supported servers, and hunt for signs of compromise given the known ransomware exploitation. | 9.8 | 100% | KEV ransomware PoC ×3 |
| mass≈25,000–100,000 internet-exposed on-premises SharePoint servers (public internet-wide scans); total on-prem installed base plausibly >1M users | |
| CVE-2025-53771 | Improper Authentication in Microsoft SharePoint Server Enables Network Spoofing CVE-2025-53771 is an improper authentication flaw (CWE-287) in Microsoft's on-premises SharePoint Server that allows an unauthenticated remote attacker to conduct spoofing over the network. Per the CVSS vector, exploitation requires no privileges and no user interaction, so an attacker who can reach the SharePoint server over the network can trigger it directly. Successful exploitation lets the attacker impersonate an authenticated user or component, producing limited but real impact on confidentiality and integrity (CVSS 6.5, medium). Any organization running on-premises SharePoint Server is affected, particularly those exposing it to the internet; no specific version numbers are provided in the source data, so defenders should consult Microsoft's advisory for their edition. No public PoC exists and it is not yet in CISA's KEV, but exploitation likelihood is near-certain (EPSS 99.7%, 100th percentile), and Microsoft has confirmed active China-linked nation-state exploitation of the closely related SharePoint ToolShell vulnerability chain, which has hit roughly 400 organizations including U.S. federal agencies. Do: Apply Microsoft's SharePoint Server security updates that ship this fix as soon as possible, prioritizing internet-facing servers, and treat this as urgent because it was patched alongside the actively exploited ToolShell chain. While patching, review authentication and web-server logs on SharePoint hosts for unexpected successful logons or anomalous requests that could indicate spoofing or compromise, and restrict network access to SharePoint (VPN, firewall rules, segmentation) if patching must be delayed. | 6.5 | 100% |
| largeTens of thousands of internet-facing SharePoint Server deployments, with a total on-prem installed base plausibly in the hundreds of thousands (estimate) |
Full article452 words · extracted from infosecurity-magazine.com · click to collapse
The ToolShell exploit, affecting on-premises Microsoft SharePoint servers, has driven a rise in threat actors exploiting public-facing applications for initial access.
In the last quarter, this tactic appeared in over 60% Cisco Talos Incident Response (Talos IR) engagements, an increase from 10% in the previous quarter.
Almost 40% of all engagements involved ToolShell activity, majorly contributing to this tactic’s rise in popularity, Cisco Talos explained in a recent report.
The ToolShell exploit chain was first made public in mid-July 2025. The attack sees CVE-2025-53770 and CVE-2025-53771, two critical and high-severity vulnerabilities in internet-facing SharePoint servers, exploited.
In July 2025, Microsoft warned that Chinese-based threat groups, Linen Typhoon and Violet Typhoon, were actively targeting the SharePoint vulnerabilities. This is likely part of a strategic campaign to gain initial access to targets across government, defense, academia and NGOs.
Active exploitation of the ToolShell vulnerabilities was first observed in the wild on July 18, a day before Microsoft issued its emergency advisory.
“Almost all Talos IR engagements responding to ToolShell activity kicked off within the following 10 days,” Cisco explained in its Quarterly Trends report, published on October 23.
Read more: US Tops Hit List as 396 SharePoint Systems Compromised Globally
Network Segmentation Crucial
The cybersecurity firm highlighted the need for network segmentation to prevent these attacks enabling threat actors to laterally move within an organization.
In one engagement by the Talos IR, the firm said the victim organization was impacted by ToolShell exploitation against a SharePoint server, then experienced a ransomware attack a few weeks later.
In the ransomware attack, Talos IR analysis indicated the actors transferred credential stealing malware from the affected public-facing SharePoint server to a SharePoint database server on the victim’s internal network.
This, Talos IR said, demonstrates how they leveraged the trusted relationship between the two servers to expand their foothold.
Ransomware Remains a Persistent Threat
Other findings in the Cisco Talos update showed that ransomware incidents made up around 20% of engagements in the third quarter of 2025, down from 50% in the previous quarter.
Talos IR responded to Warlock, Babuk and Kraken ransomware variants for the first time, while also responding to previously seen families Qilin and LockBit.
The company responded to a ransomware engagement in Q3 that it assessed with moderate confidence was attributable to the Storm-2603 threat group based on overlapping techniques, tactics and procedures (TTPs), such as the deployment of both LockBit and Warlock ransomware.
The Qilin ransomware group were also particularly active, and Cisco Talos said it will very likely continue to be a top ransomware threat through at least the remainder of 2025, pending any disruption or intervention.
Image credit: PhotoGranary02 / Shutterstock.com
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/toolshell-gains-traction/