ToolShell Exploit: Critical SharePoint Zero
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-49704+1 related CVE | Authenticated Code Injection RCE in Microsoft SharePoint | 8.8 group max | 100% | KEVRansomware | KEV |
| CVE-2025-53770 | Unauthenticated Deserialization RCE in Microsoft SharePoint Server on-premises | 9.8 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2025-53771 | Improper Authentication in Microsoft SharePoint Server Enables Network Spoofing | 6.5 | 100% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 104.238.159.149 | tives. For all versions: Conduct scanning for IP addresses: 104.238.159[.]149 131.226.2[.]6 134.199.202[.]205 188.130.206[.]168 Find th |
| ipv4 | 107.191.58.76 | ing for IP addresses 96.9.125[.]147, 104.238.159[.]149, and 107.191.58[.]76 particularly between July 18-19, 2025. Eye Security also |
| ipv4 | 131.226.2.6 | sions: Conduct scanning for IP addresses: 104.238.159[.]149 131.226.2[.]6 134.199.202[.]205 188.130.206[.]168 Find the complete Mic |
| ipv4 | 134.199.202.205 | scanning for IP addresses: 104.238.159[.]149 131.226.2[.]6 134.199.202[.]205 188.130.206[.]168 Find the complete Microsoft advisory he |
| ipv4 | 141.164.60.10 | 21.207[.]116 45.77.155[.]170 45.191.66[.]77 64.176.50[.]109 141.164.60[.]10 206.166.251[.]228 Who’s behind the attack, and what will |
| ipv4 | 188.130.206.168 | ddresses: 104.238.159[.]149 131.226.2[.]6 134.199.202[.]205 188.130.206[.]168 Find the complete Microsoft advisory here . CISA addition |
| ipv4 | 206.166.251.228 | 77.155[.]170 45.191.66[.]77 64.176.50[.]109 141.164.60[.]10 206.166.251[.]228 Who’s behind the attack, and what will happen next? On Ju |
| ipv4 | 34.121.207.116 | owing IP addresses, observed after July 21: 34.72.225[.]196 34.121.207[.]116 45.77.155[.]170 45.191.66[.]77 64.176.50[.]109 141.164.60 |
| ipv4 | 34.72.225.196 | ing for the following IP addresses, observed after July 21: 34.72.225[.]196 34.121.207[.]116 45.77.155[.]170 45.191.66[.]77 64.176.50 |
| ipv4 | 45.191.66.77 | r July 21: 34.72.225[.]196 34.121.207[.]116 45.77.155[.]170 45.191.66[.]77 64.176.50[.]109 141.164.60[.]10 206.166.251[.]228 Who’s b |
| ipv4 | 45.77.155.170 | s, observed after July 21: 34.72.225[.]196 34.121.207[.]116 45.77.155[.]170 45.191.66[.]77 64.176.50[.]109 141.164.60[.]10 206.166.25 |
| ipv4 | 64.176.50.109 | 2.225[.]196 34.121.207[.]116 45.77.155[.]170 45.191.66[.]77 64.176.50[.]109 141.164.60[.]10 206.166.251[.]228 Who’s behind the attack |
| ipv4 | 96.9.125.147 | dditionally recommends conducting scanning for IP addresses 96.9.125[.]147, 104.238.159[.]149, and 107.191.58[.]76 particularly betw |
| sha256 | 30955794792a7ce045660bb1e1917eef36f1d5865891b8110bf982382b305b27 | ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514 30955794792a7ce045660bb1e1917eef36f1d5865891b8110bf982382b305b27 8d3d3f3a17d233bc8562765e61f7314ca7a08130ac0fb153ffd09161292 |
| sha256 | 3461da3a2ddcced4a00f87dcd7650af48f97998a3ac9ca649d7ef3b7332bd997 | lable on Recorded Future’s public sandbox: File Name SHA256 3461da3a2ddcced4a00f87dcd7650af48f97998a3ac9ca649d7ef3b7332bd997 Background and first exploitation chain Previously, cyberse |
| sha256 | 8d3d3f3a17d233bc8562765e61f7314ca7a08130ac0fb153ffd091612920b0f2 | 794792a7ce045660bb1e1917eef36f1d5865891b8110bf982382b305b27 8d3d3f3a17d233bc8562765e61f7314ca7a08130ac0fb153ffd091612920b0f2 Insikt Group®’s mitigation guidance is that, regardless of |
| sha256 | 92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514 | lable on Recorded Future’s public sandbox: File Name SHA256 92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514 30955794792a7ce045660bb1e1917eef36f1d5865891b8110bf982382b3 |
From the original article
5 min read at recordedfuture.com
A zero-day exploit chain called "ToolShell" is actively being used to target on-premises Microsoft SharePoint servers worldwide, potentially affecting thousands of organizations. The attack leverages two critical vulnerabilities (CVE-2025-53770 and CVE-2025-53771) to achieve remote code execution and steal cryptographic keys, giving attackers persistent access even after organizations apply patches.
By Insikt Group® · recordedfuture.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.