Ransomware Deployed in Compromised SharePoint Servers
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-53770 | Unauthenticated Deserialization RCE in Microsoft SharePoint Server on-premises CVE-2025-53770 is a deserialization of untrusted data vulnerability (CWE-502) in Microsoft SharePoint Server on-premises that allows an unauthorized attacker to execute code over a network. It is triggered when the server deserializes attacker-controlled data, can be chained with CVE-2025-53771, and it bypasses the fixes issued for CVE-2025-49704, meaning the earlier patches are insufficient. Successful exploitation yields remote code execution on the SharePoint server, and ransomware operators are known to be using it. Any organization running SharePoint Server on-premises is affected, particularly internet-facing deployments and end-of-life versions such as SharePoint Server 2013 and earlier that can no longer be patched. The flaw is being actively exploited — it was added to CISA's KEV on 2025-07-20 with known ransomware use — and EPSS assigns it a 100% probability of exploitation within 30 days. Do: Apply Microsoft's updated SharePoint Server security updates that fix CVE-2025-53770 — these include more robust protection than the earlier CVE-2025-49704 updates — and ensure the companion CVE-2025-53771 is also addressed, following CISA and vendor mitigation instructions for supported versions. Disconnect public-facing SharePoint Server 2013 or earlier (EOL/EOS) instances, minimize internet exposure of supported servers, and hunt for signs of compromise given the known ransomware exploitation. | 9.8 | 100% | KEV ransomware PoC ×3 |
| mass≈25,000–100,000 internet-exposed on-premises SharePoint servers (public internet-wide scans); total on-prem installed base plausibly >1M users | |
| CVE-2025-53771 | Improper Authentication in Microsoft SharePoint Server Enables Network Spoofing CVE-2025-53771 is an improper authentication flaw (CWE-287) in Microsoft's on-premises SharePoint Server that allows an unauthenticated remote attacker to conduct spoofing over the network. Per the CVSS vector, exploitation requires no privileges and no user interaction, so an attacker who can reach the SharePoint server over the network can trigger it directly. Successful exploitation lets the attacker impersonate an authenticated user or component, producing limited but real impact on confidentiality and integrity (CVSS 6.5, medium). Any organization running on-premises SharePoint Server is affected, particularly those exposing it to the internet; no specific version numbers are provided in the source data, so defenders should consult Microsoft's advisory for their edition. No public PoC exists and it is not yet in CISA's KEV, but exploitation likelihood is near-certain (EPSS 99.7%, 100th percentile), and Microsoft has confirmed active China-linked nation-state exploitation of the closely related SharePoint ToolShell vulnerability chain, which has hit roughly 400 organizations including U.S. federal agencies. Do: Apply Microsoft's SharePoint Server security updates that ship this fix as soon as possible, prioritizing internet-facing servers, and treat this as urgent because it was patched alongside the actively exploited ToolShell chain. While patching, review authentication and web-server logs on SharePoint hosts for unexpected successful logons or anomalous requests that could indicate spoofing or compromise, and restrict network access to SharePoint (VPN, firewall rules, segmentation) if patching must be delayed. | 6.5 | 100% |
| largeTens of thousands of internet-facing SharePoint Server deployments, with a total on-prem installed base plausibly in the hundreds of thousands (estimate) |
Full article509 words · extracted from infosecurity-magazine.com · click to collapse
A Chinese-based threat actor has been observed using the flaws in Microsoft SharePoint to deploy ransomware on compromised systems.
In an incident update on July 23, Microsoft revealed that a group tracked as Storm-2603 is distributing Warlock ransomware on exploited SharePoint on-prem servers.
As a result, the tech giant has advised potentially affected organizations to expand their mitigation efforts to include protection against ransomware.
Storm-2603 is one of three groups observed to be exploiting on-prem SharePoint vulnerabilities, CVE-2025-53770 and CVE-2025-53771.
It has been assessed with moderate confidence that Storm-2603 is a China-based threat actor. The group has been known to deploy Warlock and LockBit ransomware.
Microsoft said it is currently unable to confidently assess the threat actor’s objectives.
The other two actors known to be exploiting the SharePoint vulnerabilities are Linen Typhoon and Violet Typhoon – two known Chinese nation-state groups primarily focused on collecting sensitive data from sectors such as government, defense, technology and human rights organizations.
The chained exploitation of the two bugs has been dubbed ‘ToolShell’ by the cybersecurity community. The attack chain appears to be sophisticated, with the threat actors bypassing identity controls and gaining privileged access in compromised systems.
Attackers Maximizing Impact
Kevin Robertson, CTO of Acumen Cyber, said the deployment of ransomware demonstrates that once inside a victim’s network, they will often look to take advantage in multiple ways.
“The attackers turning to ransomware are clearly taking advantage of CVE 2025-53770 to gain further access to environments, encrypting sensitive information, before executing ransomware hoping to get a big pay check,” he noted.
Chinese state-sponsored actors, not typically motivated by financial gain, could also be using the opportunity to deploy ransomware.
“They could be conducting reconnaissance on networks and then when they have what they need, dropping ransomware to cause further chaos for victims,” Robertson added.
SharePoint Victim Count Now Tops 400
Microsoft has told its on-prem SharePoint customers to assume compromise, even if they have fully patched the two vulnerabilities.
Organizations have been advised to urgently take mitigations such as rotating cryptographic material, engaging professional incident response and even disconnecting SharePoint from the internet.
Cybersecurity vendor Eye Security reported on July 23 that over 400 SharePoint systems have been actively compromised so far.
These exploits took place over four confirmed waves of attack on July 17, 18, 19 and 21.
Multiple waves took place on and after July 21 following a public proof-of-concept CVE-2025-53770/CVE-2025-53771 exploit script was released on GitHub, Eye Security added.
It has been reported that several high-profile US government agencies are among the victims of the SharePoint campaign.
Bloomberg reported on July 23 that on-prem SharePoint servers used by the National Nuclear Security Administration and the Department of Education were compromised, while the Washington Post reported that the Department of Health and Human Services (DHHS) had been hit.
NextGov said that it had been informed by people familiar with the matter that the Department of Homeland Security (DHS) was also among the victims of the Chinese hackers.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/ransomware-compromised-sharepoint/