Industry
Government and public sector
State-backed espionage, supplier breaches, attacks on exposed servers and targeted phishing against public bodies, and the rules that apply.
Read more
Significant cyber incident
SharePoint ToolShell attacks
In July 2025, attackers exploited flaws in on-premises Microsoft SharePoint Server in an attack chain called ToolShell.
In short
In July 2025, attackers exploited flaws in on-premises Microsoft SharePoint Server in an attack chain called ToolShell. It began with CVE-2025-49704 and CVE-2025-49706, and a variant using CVE-2025-53770 and CVE-2025-53771 got around Microsoft's first fixes. Attackers could run code without a login and steal the machine keys SharePoint uses to trust requests. Microsoft and CISA urged fast patching, key rotation and checks for compromise, and reported ransomware use.
What happened
On 19 July 2025 Microsoft warned of active attacks on on-premises SharePoint Server. The attacks used flaws that its July security update had only partly fixed. SharePoint Online in Microsoft 365 was not affected.
The EU statement says Microsoft had published updates for CVE-2025-49704 and CVE-2025-49706 on 8 July, and that exploitation of a variation was detected on 18 July. The variation used two new zero-days, CVE-2025-53770 and CVE-2025-53771, which bypassed the earlier updates. Microsoft said exploitation attempts had begun as early as 7 July.
CISA added CVE-2025-53770 to its Known Exploited Vulnerabilities Catalog on 20 July. It added CVE-2025-49704 and CVE-2025-49706 on 22 July. Microsoft released updates for all supported versions. CISA later listed more on-premises SharePoint flaws as exploited, see SharePoint on-premises exploitation wave of 2026.
Timeline
-
7 July 2025
Microsoft analysis suggests attackers were already trying to exploit CVE-2025-49706 and CVE-2025-49704.
-
8 July 2025
Microsoft publishes updates for CVE-2025-49704 and CVE-2025-49706, per the EU joint statement.
-
18 July 2025
Active exploitation of a variation of ToolShell is detected. Microsoft sees Storm-2603 deploying ransomware from this date.
-
19 July 2025
Microsoft releases an out-of-band advisory and its MSRC blog on the active attacks.
-
20 July 2025
CISA adds CVE-2025-53770 (ToolShell) to the Known Exploited Vulnerabilities Catalog.
-
21 July 2025
CERT-EU publishes Security Advisory 2025-027 (first version).
-
22 July 2025
CISA adds CVE-2025-49704 and CVE-2025-49706 to the KEV Catalog and updates its alert.
-
22 July 2025
The UK NCSC publishes its alert and the EU joint statement is released.
-
22 July 2025
Microsoft's threat blog names Linen Typhoon, Violet Typhoon and Storm-2603.
-
24 July 2025
CISA updates its alert with ransomware deployment, new web shells and detection guidance.
-
6 August 2025
CISA publishes a malware analysis report on six files tied to the four CVEs.
How the attack worked
Getting in
Attackers sent a crafted POST request to the ToolPane endpoint of an internet-facing SharePoint server. Exploiting a public-facing application (T1190) gave them access without a login. CISA also advised watching for a SignOut.aspx referrer and POSTs to ToolPane.aspx.
Stealing the keys
Attackers uploaded a script named spinstall0.aspx. It reads the server’s MachineKey data and returns it. A web shell (T1505.003) was used for this. CISA’s analysis also found DLLs built to pull machine key settings. With the keys, attackers could keep access even after a patch, which is why Microsoft and CISA asked for key rotation.
Follow-on activity by Storm-2603
Microsoft described Storm-2603 running commands from the SharePoint worker process and checking privileges with whoami. It disabled Defender through registry changes and kept access through scheduled tasks and IIS components. It dumped credentials from LSASS memory with Mimikatz (T1003.001), moved sideways with PsExec and Impacket, and used Group Policy changes (T1484.001) to push Warlock ransomware. Files were then encrypted (T1486).
Why patching was not enough
The new CVEs were bypasses of the first fixes. CISA said IIS must be restarted with iisreset.exe after key rotation, because malicious modules persist unless removed from the IIS configuration files.
ATT&CK techniques
- Technique Data Encrypted for Impact Data Encrypted for Impact is when attackers encrypt files or whole systems so the owner can no longer use them, and then hold back the key. T1486 · Impact
- Technique Exploit Public-Facing Application Exploit Public-Facing Application is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network. T1190 · Initial Access
- Technique OS Credential Dumping OS credential dumping is when an attacker pulls account login material out of a computer. T1003 · Credential Access
- Technique Server Software Component: Web Shell (T1505.003) A web shell is a small script that an attacker places on a web server. T1505.003 · Persistence
Who says who was behind it
Who attributed it, and how firm it is
Attributed by Microsoft, 22 July 2025: two named Chinese nation-state actors, Linen Typhoon and Violet Typhoon, exploited these vulnerabilities against internet-facing SharePoint servers. Microsoft also attributed ransomware deployment to Storm-2603, assessed with moderate confidence as China-based, with no links found to other known Chinese actors. Microsoft said investigations into other actors were still ongoing. CISA, CERT-EU and the NCSC did not name an actor in the pages cited here.
Malware and vulnerabilities used
- Malware Mimikatz Mimikatz is a tool that pulls Windows account logins and passwords out of a computer. Legitimate tool abused · Since 2007 · Windows
- Vulnerability SharePoint ToolShell remote code execution (CVE-2025-53770) CVE-2025-53770 is a flaw in on-premises Microsoft SharePoint Server that lets an unauthorized attacker run code over a network. CVE-2025-53770 · Microsoft · Deserialization of untrusted data (CWE-502)
Impact
The cited government pages give no count of victims. The NCSC said attacks included a limited number in the UK. Microsoft and CISA reported ransomware deployment (Warlock) on compromised systems. Attackers could read SharePoint content, including file systems and internal configuration, and run code over the network. Theft of machine keys let attackers keep access after patching. Older SharePoint versions are unsupported and will not be patched, per CERT-EU.
Government and regulator response
- 19 July 2025: Microsoft published customer guidance and an out-of-band advisory. It later released updates for SharePoint Subscription Edition, 2019 and 2016, and asked customers to enable AMSI, deploy Defender or equivalent, and rotate ASP.NET machine keys.
- 20 July 2025: CISA added CVE-2025-53770 to the KEV Catalog. On 22 July it added CVE-2025-49704 and CVE-2025-49706. Its alert was updated on 22 and 24 July with detection guidance and ransomware details.
- 22 July 2025: the UK NCSC urged immediate action and asked compromised UK organizations to report to it.
- 22 July 2025: the European Commission, ENISA, CERT-EU and the EU CSIRTs network advised isolating affected instances, assessing for compromise and updating only once exploitation is ruled out.
- 6 August 2025: CISA released a malware analysis report on six related files.
Lessons
-
A first patch can be incomplete
The July 8 updates were bypassed by CVE-2025-53770 and CVE-2025-53771, so a patched server was still exposed. Track vendor follow-up advisories for flaws that are already being attacked.
-
Patching does not remove an intruder
Machine keys may already be stolen. CISA and Microsoft asked for key rotation and an IIS restart, and CERT-EU asked for a compromise check before updating.
-
Internet-facing collaboration servers are high-value targets
The entry point was a public SharePoint endpoint, and access exposed content, file systems and configuration.
-
Unsupported versions stay exposed
CERT-EU said older SharePoint versions will not be patched and should be considered vulnerable. CISA advised removing end-of-life servers from the internet.
-
Exploitation moved fast
Microsoft saw attempts from 7 July, and ransomware use from 18 July, before the 19 July advisory.
-
Endpoint scanning controls mattered
Microsoft and CISA pointed to AMSI and endpoint protection to stop unauthenticated exploitation and post-exploit activity.
What to check in your own organization
-
List every SharePoint server
Find all on-premises SharePoint Server instances, their versions, and which are reachable from the internet. SharePoint Online was not affected.
-
Confirm the update level
Check that the July 2025 updates for your version (Subscription Edition, 2019 or 2016) are installed, and that both 2016 and 2019 updates are applied.
-
Check AMSI
Confirm AMSI is on, in Full Mode where available, with Defender Antivirus or an equivalent on every SharePoint server.
-
Rotate machine keys and restart IIS
Rotate ASP.NET machine keys, then run iisreset.exe. CISA says to rotate before and after patching, and to remove malicious IIS modules first.
-
Hunt for the web shell
Search for spinstall0.aspx and its variants in the SharePoint LAYOUTS folders, and for w3wp.exe launching encoded PowerShell.
-
Review web logs
Look for POSTs to ToolPane.aspx and requests with a SignOut.aspx referrer, from 7 July 2025 onward.
-
Check post-exploit signs
Look for Defender being disabled by registry change, new scheduled tasks, LSASS access, PsExec use, and unexpected Group Policy changes.
-
Retire unsupported servers
Remove end-of-life SharePoint from the internet and plan an upgrade.
Where it happened
Questions
What is ToolShell?
CISA and the EU joint statement use the name for the SharePoint chain of CVE-2025-49704 and CVE-2025-49706. The later CVE-2025-53770 and CVE-2025-53771 bypassed Microsoft's first updates.
Was SharePoint Online affected?
No. Microsoft said only on-premises SharePoint Server was affected, and SharePoint Online in Microsoft 365 was not.
Which versions were affected?
CERT-EU lists SharePoint Subscription Edition, 2019 and Enterprise Server 2016. Older versions are unsupported and will not be patched.
Did patching fix it?
Microsoft released updates for supported versions. Microsoft, CISA and CERT-EU also advised key rotation and a compromise check, because attackers could steal machine keys.
Who was behind it?
Microsoft attributed exploitation to Linen Typhoon and Violet Typhoon (Chinese state actors) and ransomware use to Storm-2603. No other cited government page names an actor.
Was ransomware used?
Yes. Microsoft and CISA reported Warlock ransomware on compromised systems.
In our research
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.