CVE-2025-53770
published 2025-07-20CVE-2025-53770: Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware…
PriorityP1100critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2025-07-21
Exploited in the wild
EPSS
99.98%
100.0th percentile
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.
Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild.
Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sharepoint_enterprise_server_2016 | >= 16.0.0 < 16.0.5513.1001 | 16.0.5513.1001 |
| microsoft | microsoft_sharepoint_server_2019 | >= 16.0.0 < 16.0.10417.20037 | 16.0.10417.20037 |
| microsoft | microsoft_sharepoint_server_subscription_edition | >= 16.0.0 < 16.0.18526.20508 | 16.0.18526.20508 |
| microsoft | sharepoint_server | < 16.0.18526.20508 | 16.0.18526.20508 |
| microsoft | sharepoint_server | — | — |
| microsoft | sharepoint_server | — | — |
| msrc | microsoft_sharepoint_enterprise_server_2016 | — | — |
| msrc | microsoft_sharepoint_server_2019 | — | — |
| msrc | microsoft_sharepoint_server_subscription_edition | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for POST requests to /_layouts/15/ToolPane.aspx?DisplayMode=Edit with a Referer header of /_layouts/SignOut.aspx — this is the authentication bypass step of the ToolShell chain (CVE-2025-53771). ↗
- →Alert on creation of any .aspx files (especially spinstall0.aspx) in the SharePoint LAYOUTS directory: C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\ ↗
- →Detect w3wp.exe spawning encoded PowerShell child processes — a strong indicator of post-exploitation activity on a compromised SharePoint server. ↗
- →Active exploitation was first observed July 18, 2025; nearly all incident response engagements began within 10 days. Prioritize hunting on SharePoint servers exposed to the internet during this window. ↗
- →A PoC exploit for CVE-2025-53770 was published on GitHub after patches were released, significantly lowering the barrier for additional threat actors. Treat any unpatched internet-facing SharePoint server as likely compromised. ↗
- ·CVE-2025-53770 and CVE-2025-53771 are bypasses of previously patched flaws (CVE-2025-49704 and CVE-2025-49706 respectively); servers that applied July 2025 Patch Tuesday updates are still vulnerable and require the emergency patches. ↗
- ·SharePoint Online (Microsoft 365) is NOT affected; only on-premises SharePoint Server deployments are vulnerable, including self-managed instances hosted in cloud environments (Azure, AWS, GCP). ↗
- ·SharePoint Server 2010 and 2013 are end-of-life and will not receive patches; they are confirmed affected and should be isolated or upgraded. ↗
- ·In many reported cases it is unclear whether observed in-the-wild exploitation reflects abuse of the original CVEs (CVE-2025-49704/49706) or their bypasses (CVE-2025-53770/53771); IOCs may overlap across both exploit generations. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck8.8HIGH
cisa8.8HIGH
vendor_msrc9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Microsoft SharePoint Improper Authentication Vulnerability
cisa·2025-07-22·CVSS 8.8
CVE-2025-49706 [HIGH] CWE-287 Microsoft SharePoint Improper Authentication Vulnerability
Vulnerability: Microsoft SharePoint Improper Authentication Vulnerability
Affected: Microsoft SharePoint
Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.
Required Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions
CISA
Microsoft SharePoint Code Injection Vulnerability
cisa·2025-07-22·CVSS 8.8
CVE-2025-49704 [HIGH] CWE-94 Microsoft SharePoint Code Injection Vulnerability
Vulnerability: Microsoft SharePoint Code Injection Vulnerability
Affected: Microsoft SharePoint
Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
Required Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the a
CISA
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
cisa·2025-07-20·CVSS 8.8
CVE-2025-53770 [HIGH] CWE-502 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Vulnerability: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Affected: Microsoft SharePoint
Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
Required Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendo
Microsoft
Microsoft SharePoint Server Spoofing Vulnerability
vendor_msrc·2025-07-08·CVSS 6.5
CVE-2025-53771 [HIGH] CWE-287 Microsoft SharePoint Server Spoofing Vulnerability
Microsoft SharePoint Server Spoofing Vulnerability
Description: Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
FAQ: Are the two new CVEs that were released related to the two SharePoint vulnerabilities that were documented by CVE-2025-49704 and CVE-2025-49706?
Yes, the update for CVE-2025-53770 includes more robust protections than the update for CVE-2025-49704. The update for CVE-2025-53771 includes more robust protections than the update for CVE-2025-49706.
FAQ: There are multiple update packages available for some of the affected software. Do I need to install all the updates listed in the Security Updates table for the software?
Yes. Customers should apply all updates offered for the software installed on th
Microsoft
Microsoft SharePoint Server Remote Code Execution Vulnerability
vendor_msrc·2025-07-08·CVSS 9.8
CVE-2025-53770 [HIGH] CWE-502 Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
Description: Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.
Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild.
Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
FAQ: 7/20/2025 Update: Updates are now available for Microsoft SharePoint Server Subscription Edition and Microsoft SharePoint Server 2019.
Why are there no links to the update to protect from this vulnerability?
Microsoft is preparing and fully testing a comprehen
GHSA
GHSA-xcrc-8vqv-vc8r: Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network
ghsa_unreviewed·2025-07-20·CVSS 9.8
CVE-2025-53770 [CRITICAL] CWE-502 GHSA-xcrc-8vqv-vc8r: Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.
Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild.
Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
VulnCheck
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
vulncheck·2025·CVSS 8.8
CVE-2025-53770 [HIGH] CWE-502 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
Affected: Microsoft SharePoint
Required Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions
VulnCheck
Microsoft SharePoint Code Injection Vulnerability
vulncheck·2025·CVSS 8.8
CVE-2025-49704 [HIGH] CWE-94 Microsoft SharePoint Code Injection Vulnerability
Microsoft SharePoint Code Injection Vulnerability
Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
Affected: Microsoft SharePoint
Required Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD
VulnCheck
Microsoft SharePoint Improper Authentication
vulncheck·2025·CVSS 6.5
CVE-2025-53771 [MEDIUM] Microsoft SharePoint Improper Authentication
Microsoft SharePoint Improper Authentication
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Affected: Microsoft SharePoint
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Known Ransomware Campaign Use: Known
Exploitation References: https://research.eye.security/sharepoint-under-siege/; https://blog.qualys.com/vulnerabilities-threat-research/2025/07/21/toolshell-zero-day-microsoft-rushes-emergency-patch-for-actively-exploited-sharepoint-vulnerabilities; https://blog.talosintelligence.com/toolshell-affecting-sharepoint-servers/; https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2
VulnCheck
Microsoft SharePoint Improper Authentication Vulnerability
vulncheck·2025·CVSS 8.8
CVE-2025-49706 [HIGH] CWE-287 Microsoft SharePoint Improper Authentication Vulnerability
Microsoft SharePoint Improper Authentication Vulnerability
Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.
Affected: Microsoft SharePoint
Required Action: Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follo
Elastic
Potential Toolshell Initial Exploit (CVE-2025-53770 & CVE-2025-53771)
elastic_rules·CVSS 9.8
CVE-2025-53770 [CRITICAL] Potential Toolshell Initial Exploit (CVE-2025-53770 & CVE-2025-53771)
Potential Toolshell Initial Exploit (CVE-2025-53770 & CVE-2025-53771)
Identifies potential exploitation of CVE-2025-53770 and CVE-2025-53771 in IIS web servers on SharePoint sites. Toolshell
is an exploit chain that leverages vulnerabilities in SharePoint/IIS to gain unauthorized access and execute commands.
This rule detects HTTP requests that match specific patterns indicative of the exploit attempt.
Query:
data_stream.dataset : "network_traffic.http" and
url.path: (/_layouts*ToolPane.aspx* or /_layouts*toolpane.aspx*) and
http.request.referrer: *SignOut.aspx and
network.direction: "ingress" and
http.request.method: "POST" and
request: (*MSOTlPn_Uri* and *DisplayMode*) and
http.request.body.bytes > 2000
Elastic
Potential VIEWSTATE RCE Attempt on SharePoint/IIS
elastic_rules·CVSS 9.8
[CRITICAL] Potential VIEWSTATE RCE Attempt on SharePoint/IIS
Potential VIEWSTATE RCE Attempt on SharePoint/IIS
Detects potential remote code execution (RCE) attempts targeting IIS web servers running SharePoint via malicious
VIEWSTATE payloads in HTTP POST requests. Attackers may exploit insecure deserialization in the VIEWSTATE parameter to
execute arbitrary code. This rule identifies suspicious requests containing VIEWSTATE data and other indicators of
exploitation, specifically those associated with the Toolshell exploit chain. Toolshell leverages vulnerabilities
(CVE-2025-53770 and CVE-2025-53771) for initial access, enabling adversaries to deploy a webshell, steal machine keys,
sign VIEWSTATE payloads offline, and subsequently send signed payloads to the server to achieve code execution.
Query:
data_stream.dataset : "network_traffic.http" an
Sigma
Suspicious File Write to SharePoint Layouts Directory
sigma·CVSS 8.8
CVE-2025-49704 [HIGH] Suspicious File Write to SharePoint Layouts Directory
Suspicious File Write to SharePoint Layouts Directory
Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation.
This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.
Detection:
condition: selection
selection:
Image|endswith:
- \cmd.exe
- \powershell_ise.exe
- \powershell.exe
- \pwsh.exe
- \w3wp.exe
TargetFilename|contains:
- \15\TEMPLATE\LAYOUTS\
- \16\TEMPLATE\LAYOUTS\
TargetFilename|endswith:
- .asax
- .ascx
- .ashx
- .asmx
- .asp
- .aspx
- .bat
- .cmd
- .cer
- .config
- .hta
- .js
- .jsp
- .jspx
- .php
- .ps1
- .vbs
TargetFilename|startswith:
- C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\
- C:\Program Files (x
Exploit-DB
Microsoft SharePoint Server 2019 (16.0.10383.20020) - Remote Code Execution (RCE)
exploitdb·2025-08-11·CVSS 9.8
CVE-2025-53770 [CRITICAL] Microsoft SharePoint Server 2019 (16.0.10383.20020) - Remote Code Execution (RCE)
Microsoft SharePoint Server 2019 (16.0.10383.20020) - Remote Code Execution (RCE)
---
# Exploit Title: Microsoft SharePoint Server 2019 – Remote Code Execution (RCE)
# Google Dork: intitle:"Microsoft SharePoint" inurl:"/_layouts/15/ToolPane.aspx"
# Date: 2025-08-07
# Exploit Author: Agampreet Singh (RedRoot Tool Maker – https://github.com/Agampreet-Singh/RedRoot)
# Vendor Homepage: https://www.microsoft.com
# Software Link: https://www.microsoft.com/en-us/microsoft-365/sharepoint/collaboration
# Version: SharePoint Server 2019 (16.0.10383.20020)
# Tested on: Windows Server 2019 (x64)
# CVE: CVE-2025-53770
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
Exploit Author: Agampreet Singh (RedRoot Tool Maker)
RedRoot Repository: https://github.com/Agampreet-Singh/RedRoot
This PoC demonst
Nuclei
SharePoint Webshell - ToolShell
nuclei·CVSS 9.8
CVE-2025-53770 [CRITICAL] SharePoint Webshell - ToolShell
SharePoint Webshell - ToolShell
Detects a persistent webshell named 'spinstall0.aspx' deployed on Microsoft SharePoint servers.
This file exposes sensitive cryptographic machineKey values from the SharePoint configuration,
indicating the presence of a ToolShell backdoor implant. This implant is linked to targeted
post-auth RCE campaigns exploiting CVE-2025-53770.
Template:
id: sharepoint-toolshell-backdoor
info:
name: SharePoint Webshell - ToolShell
author: johnk3r
severity: critical
description: |
Detects a persistent webshell named 'spinstall0.aspx' deployed on Microsoft SharePoint servers.
This file exposes sensitive cryptographic machineKey values from the SharePoint configuration,
indicating the presence of a ToolShell backdoor implant. This implant is linked to targeted
post-auth
Nuclei
Microsoft SharePoint Server - Authentication Bypass (ToolShell)
nuclei·CVSS 6.5
CVE-2025-53771 [MEDIUM] Microsoft SharePoint Server - Authentication Bypass (ToolShell)
Microsoft SharePoint Server - Authentication Bypass (ToolShell)
Microsoft Office SharePoint Server contains an improper authentication vulnerability that allows unauthorized attackers to perform spoofing over a network. By crafting a POST request to /_layouts/15/ToolPane.aspx with a forged Referer header (/_layouts/SignOut.aspx), attackers can bypass authentication mechanisms and gain unauthorized access to protected endpoints. This vulnerability is part of the ToolShell exploit chain and is a patch bypass for CVE-2025-49706. When chained with CVE-2025-53770 (deserialization vulnerability), it enables unauthenticated remote code execution on SharePoint Server.
Template:
id: CVE-2025-53771
info:
name: Microsoft SharePoint Server - Authentication Bypass (ToolShell)
author: _l0gg,SamIntru
Nuclei
Microsoft SharePoint Server - Authentication Bypass
nuclei·CVSS 6.5
CVE-2025-49706 [MEDIUM] Microsoft SharePoint Server - Authentication Bypass
Microsoft SharePoint Server - Authentication Bypass
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Template:
id: CVE-2025-49706
info:
name: Microsoft SharePoint Server - Authentication Bypass
author: daffainfo
severity: medium
description: |
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
impact: |
Unauthenticated attackers can spoof authentication by manipulating the Referer header to access ToolPane functionality, potentially enabling unauthorized actions on SharePoint sites.
remediation: |
Apply the Microsoft security patches for SharePoint Server as described in the MSRC update guide.
reference:
- https://msrc.microsoft.com/update-gu
Metasploit
Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell)
metasploit·CVSS 8.8
CVE-2025-49706 [HIGH] Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell)
Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell)
This module exploits the authentication bypass vulnerabilities CVE-2025-49706 and CVE-2025-53771, and an unsafe deserialization vulnerability CVE-2025-49704, to achieve unauthenticated RCE against a vulnerable Microsoft SharePoint Server. The vulnerability CVE-2025-53770 was disclosed as being a patch bypass of CVE-2025-49704, and as described by the finders, CVE-2025-53770 targets a different endpoint within the /_vti_bin/ URI path. As this exploit module does not target the endpoint associated with CVE-2025-53770 (per the original finders), we believe this module is best described as exploiting CVE-2025-49704 and not CVE-2025-53770.
Nuclei
Microsoft SharePoint Server - Remote Code Execution (ToolShell)
nuclei·CVSS 9.8
CVE-2025-53770 [CRITICAL] Microsoft SharePoint Server - Remote Code Execution (ToolShell)
Microsoft SharePoint Server - Remote Code Execution (ToolShell)
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. This vulnerability is part of the ToolShell exploit chain and when combined with CVE-2025-53771 (authentication bypass), enables unauthenticated remote code execution. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
Template:
id: CVE-2025-53770
info:
name: Microsoft SharePoint Server - Remote Code Execution (ToolShell)
aut
Tenable
CVE-2026-32201, CVE-2026-45659, CVE-2026-56164: Frequently Asked Questions About Active Exploitation of Microsoft SharePoint Server Vulnerabilities
blogs_tenable·2026-07-16·CVSS 6.5
CVE-2026-32201 [MEDIUM] CVE-2026-32201, CVE-2026-45659, CVE-2026-56164: Frequently Asked Questions About Active Exploitation of Microsoft SharePoint Server Vulnerabilities
## CVE-2026-32201, CVE-2026-45659, CVE-2026-56164: Frequently Asked Questions About Active Exploitation of Microsoft SharePoint Server Vulnerabilities
Four Microsoft SharePoint Server vulnerabilities are under active exploitation, prompting CISA to issue a hardening alert. An additional high-severity flaw recently patched adds pressure for organizations running on-premises deployments.
## Key Takeaways
CISA confirmed active exploitation of three on-premises SharePoint Server vulnerabilities (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164), used to gain unauthorized access, establish remote code execution, steal IIS machine keys and deploy malware for persistence.
Two additional SharePoint Server vulnerabilities disclosed on July 14, 2026, CVE-2026-55040 and CVE-2026-58644, were not yet
Securelist
Exploits and vulnerabilities in Q1 2026
blogs_securelist·2026-05-07·CVSS 7.8
CVE-2026-21519 [HIGH] Exploits and vulnerabilities in Q1 2026
Alexander Kolesnikov
Table of Contents
Statistics on registered vulnerabilities
Exploitation statistics
Windows and Linux vulnerability exploitation
Most common published exploits
Vulnerability exploitation in APT attacks
C2 frameworks
Notable vulnerabilities
CVE-2026-21519: Desktop Window Manager vulnerability
RegPwn (CVE-2026-21533): a system settings access control vulnerability
CVE-2026-21514: a Microsoft Office vulnerability
Clawdbot (CVE-2026-25253): an OpenClaw vulnerability
CVE-2026-34070: LangChain framework vulnerability
CVE-2026-22812: an OpenCode vulnerability
Conclusion and advice
Authors
Alexander Kolesnikov
During Q1 2026, the exploit kits leveraged by threat actors to target user systems expanded once again, incorporating new exploits for the Microsoft Off
Mandiant
Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat Landscape
blogs_mandiant·2026-03-16
Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat Landscape
## Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat Landscape
## Google Threat Intelligence Group
## Google Threat Intelligence
Visibility and context on the threats that matter most.
Written by: Bavi Sadayappan, Zach Riddle, Ioana Teaca, Kimberly Goody, Genevieve Stark
## Introduction
Since 2018, when many financially motivated threat actors began shifting their monetization strategy to post-compromise ransomware deployments, ransomware has become one of the most pervasive threats to organizations across almost every industry vertical and region. In recent years ransomware operations have evolved, creating a robust ecosystem that has lowered the barrier to entry via the commoditization and specialization of the supporting underground communities, w
Mandiant
Ransomware Tactics, Techniques, and Procedures in a Shifting Threat Landscape
blogs_mandiant·2026-03-16
Ransomware Tactics, Techniques, and Procedures in a Shifting Threat Landscape
Threat Intelligence
# Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat Landscape
March 16, 2026
##### Google Threat Intelligence Group
##### Google Threat Intelligence
Visibility and context on the threats that matter most.
Contact Us & Get a Demo
Written by: Bavi Sadayappan, Zach Riddle, Ioana Teaca, Kimberly Goody, Genevieve Stark
### Introduction
Since 2018, when many financially motivated threat actors began shifting their monetization strategy to post-compromise ransomware deployments, ransomware has become one of the most pervasive threats to organizations across almost every industry vertical and region. In recent years ransomware operations have evolved, creating a robust ecosystem that has lowered the barrier to entry via the commoditiza
Securelist
Vulnerability landscape in Q4 2025
blogs_securelist·2026-03-06
Vulnerability landscape in Q4 2025
Table of Contents
- Statistics on registered vulnerabilities
- Exploitation statistics
- Vulnerability exploitation in APT attacks
- C2 frameworks
- Notable vulnerabilities
- Conclusion and advice
Authors
- Alexander Kolesnikov
The fourth quarter of 2025 went down as one of the most intense periods on record for high-profile, critical vulnerability disclosures, hitting popular libraries and mainstream applications. Several of these vulnerabilities were picked up by attackers and exploited in the wild almost immediately.
In this report, we dive into the statistics on published vulnerabilities and exploits, as well as the known vulnerabilities leveraged with popular C2 frameworks throughout Q4 2025.
## Statistics on registered vulnerabilities
This section contains statistics on regis
Securelist
Exploits and vulnerabilities in Q4 2025
blogs_securelist·2026-03-06·CVSS 7.8
CVE-2025-55182 [HIGH] Exploits and vulnerabilities in Q4 2025
Table of Contents
Statistics on registered vulnerabilities
Exploitation statistics
Windows and Linux vulnerability exploitation
Most common published exploits
Vulnerability exploitation in APT attacks
C2 frameworks
Notable vulnerabilities
React2Shell (CVE-2025-55182): a vulnerability in React Server Components
CVE-2025-54100: command injection during the execution of curl (Invoke-WebRequest)
CVE-2025-11001: a vulnerability in 7-Zip
RediShell (CVE-2025-49844): a vulnerability in Redis
CVE-2025-24990: a vulnerability in the ltmdm64.sys driver
CVE-2025-59287: a vulnerability in Windows Server Update Services (WSUS)
Conclusion and advice
Authors
Alexander Kolesnikov
The fourth quarter of 2025 went down as one of the most intense periods on record for high-profile, critical vul
Greynoiseio
The Noise in the Silence: Unmasking CISA's Hidden KEV Ransomware Updates
blogs_greynoiseio·2026-02-02
The Noise in the Silence: Unmasking CISA's Hidden KEV Ransomware Updates
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Sentinelone
12 Months of Fighting Cybercrime & Defending Enterprises | The SentinelLABS 2025 Review
blogs_sentinelone·2026-01-06
12 Months of Fighting Cybercrime & Defending Enterprises | The SentinelLABS 2025 Review
Over the past twelve months, SentinelLABS research revealed how threat actors have changed their operational approach in ways previously unseen. Among our many research publications during 2025, we exposed North Korean threat actors monitoring the same cyber threat intelligence platforms defenders use to share indicators of compromise, and revealed how a single cryptocurrency phishing operation deployed over 38,000 malicious subdomains across trusted free-tier platforms.
2025 also saw artificial intelligence transition from theoretical threat to practical reality, though not in the revolutionary ways many predicted. Instead, AI emerged as a force multiplier, with threat actors weaponizing large language models to scale attacks, generate convincing social engineering content, and automate
Sentinelone
12 Months of Fighting Cybercrime & Defending Enterprises | The SentinelLABS 2025 Review
blogs_sentinelone·2026-01-06
12 Months of Fighting Cybercrime & Defending Enterprises | The SentinelLABS 2025 Review
Over the past twelve months, SentinelLABS research revealed how threat actors have changed their operational approach in ways previously unseen. Among our many research publications during 2025, we exposed North Korean threat actors monitoring the same cyber threat intelligence platforms defenders use to share indicators of compromise, and revealed how a single cryptocurrency phishing operation deployed over 38,000 malicious subdomains across trusted free-tier platforms.
2025 also saw artificial intelligence transition from theoretical threat to practical reality, though not in the revolutionary ways many predicted. Instead, AI emerged as a force multiplier, with threat actors weaponizing large language models to scale attacks, generate convincing social engineering content, and automate
Checkpoint
Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation
blogs_checkpoint·2025-12-16
CVE-2025-49706 Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation
## Key Findings
In recent months, Check Point Research has identified a new wave of at
Securelist
Exploits and vulnerabilities in Q3 2025
blogs_securelist·2025-12-03·CVSS 7.8
CVE-2025-49704 [HIGH] Exploits and vulnerabilities in Q3 2025
Table of Contents
Statistics on registered vulnerabilities
Exploitation statistics
Windows and Linux vulnerability exploitation
Most common published exploits
Vulnerability exploitation in APT attacks
C2 frameworks
Interesting vulnerabilities
ToolShell (CVE-2025-49704 and CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771): insecure deserialization and an authentication bypass
CVE-2025-8088: a directory traversal vulnerability in WinRAR
CVE-2025-41244: a privilege escalation vulnerability in VMware Aria Operations and VMware Tools
Conclusion and advice
Authors
Alexander Kolesnikov
In the third quarter, attackers continued to exploit security flaws in WinRAR, while the total number of registered vulnerabilities grew again. In this report, we examine statistics on published vuln
Huntress
Velociraptor Misuse, Pt. II: The Eye of the Storm
blogs_huntress·2025-12-03
Velociraptor Misuse, Pt. II: The Eye of the Storm
Acknowledgements: Special thanks to Ben Folland, Anna Pham, Michael Tigges, and Anton Ovrutsky for contributing to this investigation and writeup.
We recently outlined an incident on November 12 where threat actors exploited a vulnerability in Windows Server Update Services (WSUS) before installing a legitimate open source tool called Velociraptor. Velociraptor is a digital forensics and incident response (DFIR) tool that we have seen threat actors abuse recently in attacks in order to set up command-and-control (C2) communications.
Beyond this most recent incident, the Huntress SOC investigated and reported three incidents through September and November that involved the threat actor installing Velociraptor and using it for C2 of impacted endpoints. Some of the top takeaways from these
Securelist
Analyzing the vulnerability landscape in Q3 2025
blogs_securelist·2025-12-03
Analyzing the vulnerability landscape in Q3 2025
Table of Contents
- Statistics on registered vulnerabilities
- Exploitation statistics
- Vulnerability exploitation in APT attacks
- C2 frameworks
- Interesting vulnerabilities
- Conclusion and advice
Authors
- Alexander Kolesnikov
In the third quarter, attackers continued to exploit security flaws in WinRAR, while the total number of registered vulnerabilities grew again. In this report, we examine statistics on published vulnerabilities and exploits, the most common security issues impacting Windows and Linux, and the vulnerabilities being leveraged in APT attacks that lead to the launch of widespread C2 frameworks. The report utilizes anonymized Kaspersky Security Network data, which was consensually provided by our users, as well as information from open sources.
## Statistics on
Zscaler
CVE-2025-50165: Windows Graphics Component Flaw | ThreatLabz
blogs_zscaler·2025-11-20·CVSS 9.8
[CRITICAL] CVE-2025-50165: Windows Graphics Component Flaw | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Tenable
Cybersecurity Snapshot: AI Will Take Center Stage in Cyber in 2026, Google Says, as MITRE Revamps ATT&CK Framework
blogs_tenable·2025-11-07
Cybersecurity Snapshot: AI Will Take Center Stage in Cyber in 2026, Google Says, as MITRE Revamps ATT&CK Framework
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response
blogs_talos·2025-10-23
IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response
Threat actors predominately exploited public-facing applications for initial access this quarter, with this tactic appearing in over 60 percent of Cisco Talos Incident Response (Talos IR) engagements – a notable increase from less than 10 percent last quarter. This spike is largely attributable to a wave of engagements involving ToolShell, an attack chain that targets on-premises Microsoft SharePoint servers through exploitation of vulnerabilities that were publicly disclosed in July. We also saw an increase in post-exploitation phishing campaigns launched from compromised valid accounts this quarter, a trend we noted last quarter, with threat actors using this technique to expand their attack both within the compromised organizations as well as to external partner entities.
Watch this di
Talos
IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response
blogs_talos·2025-10-23
IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response
## IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid response
Threat actors predominately exploited public-facing applications for initial access this quarter, with this tactic appearing in over 60 percent of Cisco Talos Incident Response (Talos IR) engagements – a notable increase from less than 10 percent last quarter. This spike is largely attributable to a wave of engagements involving ToolShell , an attack chain that targets on-premises Microsoft SharePoint servers through exploitation of vulnerabilities that were publicly disclosed in July. We also saw an increase in post-exploitation phishing campaigns launched from compromised valid accounts this quarter, a trend we noted last quarter, with threat actors using this technique to expan
Bleepingcomputer
Sharepoint ToolShell attacks targeted orgs across four continents
blogs_bleepingcomputer·2025-10-22·CVSS 8.8
CVE-2025-53770 [HIGH] Sharepoint ToolShell attacks targeted orgs across four continents
## Sharepoint ToolShell attacks targeted orgs across four continents
## Bill Toulas
Hackers believed to be associated with China have leveraged the ToolShell vulnerability (CVE-2025-53770) in Microsoft SharePoint in attacks targeting government agencies, universities, telecommunication service providers, and finance organizations.
The security flaw affects on-premise SharePoint servers and was disclosed as an actively exploited zero-day on July 20, after multiple hacking groups tied to China leveraged it in widespread attacks. Microsoft released emergency updates the following day.
The issue is a bypass for CVE-2025-49706 and CVE-2025-49704, two flaws that Viettel Cyber Security researchers had demonstrated at the Pwn2Own Berlin hacking competition in May, and can be leveraged remotely
Zscaler
Deception Technology: Indispensable Defense for Detecting
blogs_zscaler·2025-09-29
Deception Technology: Indispensable Defense for Detecting
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Bleepingcomputer
Target-rich environment: Why Microsoft 365 has become the biggest risk
blogs_bleepingcomputer·2025-09-18
Target-rich environment: Why Microsoft 365 has become the biggest risk
## Target-rich environment: Why Microsoft 365 has become the biggest risk
## Acronis
Microsoft 365 has become the central nervous system of modern business — and cybercriminals know it. Just as Windows became the primary target for attackers because of its market dominance in the 1990s and 2000s,
Microsoft 365 now finds itself in the crosshairs for having "won" the email and collaboration war.
With over 400 million paid Office 365 seats worldwide and countless organizations relying on its integrated suite of applications, Microsoft 365 represents the ultimate target-rich environment for threat actors.
## The winner's curse: Success breeds risk
The parallel between Windows' security journey and Microsoft 365's current predicament is striking. Windows has become a prime target of attac
Zscaler
High-Fidelity Threat Detection: Deception Customer Stories
blogs_zscaler·2025-09-16
High-Fidelity Threat Detection: Deception Customer Stories
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Zscaler
Detecting Kerberos and other AD attacks
blogs_zscaler·2025-09-12
Detecting Kerberos and other AD attacks
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Trendmicro
Warlock: From SharePoint Vulnerability Exploit to Enterprise Ransomware
blogs_trendmicro·2025-08-20
Warlock: From SharePoint Vulnerability Exploit to Enterprise Ransomware
Ransomware
# Warlock: From SharePoint Vulnerability Exploit to Enterprise Ransomware
Warlock ransomware exploits unpatched Microsoft SharePoint vulnerabilities to gain access, escalate privileges, steal credentials, move laterally, and deploy ransomware with data exfiltration across enterprise environments.
By: Jeffrey Francis Bonaobra, Joshua Aquino, Mohammed Malubay, John Paul Lim, Emmanuel Panopio, Emmanuel Roll, Melvin Singwa, Carl Jayson Peliña, Armando Nathaniel Pedragoza
2025/08/20
Read time: ( words)
Save to Folio
Key takeaways
- Warlock ransomware operators exploited vulnerable Microsoft SharePoint servers, using targeted HTTP POST requests to upload web shells, enabling reconnaissance and credential theft. More details on these vulnerabilities and how Trend Micro protects
Bleepingcomputer
Colt Telecom attack claimed by WarLock ransomware, data up for sale
blogs_bleepingcomputer·2025-08-15
Colt Telecom attack claimed by WarLock ransomware, data up for sale
## Colt Telecom attack claimed by WarLock ransomware, data up for sale
## Bill Toulas
UK-based telecommunications company Colt Technology Services is dealing with a cyberattack that has caused a multi-day outage of some of the company's operations, including hosting and porting services, Colt Online, and Voice API platforms.
The British telecommunications and network services provider disclosed that the attack started on August 12 and the disruption continues as its IT staff works around the clock to mitigate its effects.
Founded in 1992 as City of London Telecommunications (COLT) and acquired by Fidelity Investments in 2015, Colt is a major telecommunications service provider operating in 30 countries across Europe, Asia, and North America. The company employs 75,000 km of fiber netwo
Bleepingcomputer
Canada’s House of Commons investigating data breach after cyberattack
blogs_bleepingcomputer·2025-08-14·CVSS 9.8
[CRITICAL] Canada’s House of Commons investigating data breach after cyberattack
## Canada’s House of Commons investigating data breach after cyberattack
## Sergiu Gatlan
Employees and House of Commons members were also urged to be aware of potential fraudulent attempts to use the information stolen during the attack, which could be used to target and impersonate parliamentarians or exploited in scams.
The Canadian Centre for Cyber Security (Cyber Centre), a part of the country's Communications Security Establishment (CSE), told BleepingComputer that it's supporting the House of Commons' ongoing investigation but didn't link the attack to a particular threat group.
"However, we can tell you that we are aware of the incident and working with the House of Commons to provide support," said the Cyber Centre.
"Attribution of a cyber incident is difficult. Investigating
Tenable
Cybersecurity Snapshot: CISA Analyzes Malware Used in SharePoint Attacks, as U.K. Boosts Cyber Assessment Framework
blogs_tenable·2025-08-08
Cybersecurity Snapshot: CISA Analyzes Malware Used in SharePoint Attacks, as U.K. Boosts Cyber Assessment Framework
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Unit42
Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
blogs_unit42·2025-08-05·CVSS 8.8
CVE-2025-49704 [HIGH] Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
## Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
Hiroaki Hara
Mark Lim
Published: August 5, 2025
High Profile Threats
Threat Research
Vulnerabilities
Backdoor
CL-CRI-1040
CVE-2025-49704
CVE-2025-49706
CVE-2025-53770
CVE-2025-53771
LockBit
Microsoft
SharePoint
Storm-2603
## Executive Summary
Unit 42 observed notable overlaps between Microsoft’s reporting on ToolShell activity (an exploit chain affecting SharePoint vulnerabilities) and activity that we have been separately tracking. The activity, which we track as CL-CRI-1040, caught our attention by deploying a tool set that we call Project AK47, which includes a backdoor, ransomware and loaders.
Microsoft's report named a suspected China-based threat actor, Storm-2603. Based on our analysis o
Unit42
Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
blogs_unit42·2025-08-05
Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks
## Executive Summary
Unit 42 observed notable overlaps between Microsoft’s reporting on ToolShell activity (an exploit chain affecting SharePoint vulnerabilities) and activity that we have been separately tracking. The activity, which we track as CL-CRI-1040, caught our attention by deploying a tool set that we call Project AK47, which includes a backdoor, ransomware and loaders.
Microsoft's report named a suspected China-based threat actor, Storm-2603. Based on our analysis of host- and network-based artifacts, we assess with high confidence that Storm-2603 is related to the activity cluster that we track as CL-CRI-1040. We initially noted this in our threat brief covering exploitation of recent SharePoint vulnerabilities, and here further expand on our observations. (See Table 1 in the
Bleepingcomputer
The Heat Wasn't Just Outside: Cyber Attacks Spiked in Summer 2025
blogs_bleepingcomputer·2025-08-05·CVSS 9.8
[CRITICAL] The Heat Wasn't Just Outside: Cyber Attacks Spiked in Summer 2025
## The Heat Wasn't Just Outside: Cyber Attacks Spiked in Summer 2025
## Picus Security
Summer 2025 wasn't just hot; it was relentless.
Ransomware hammered hospitals, retail giants suffered data breaches, insurance firms were hit by phishing, and nation-state actors launched disruptive campaigns.
From stealthy PowerShell loaders to zero-day SharePoint exploits, attackers kept defenders on their heels.
This report breaks down the season's most high-impact incidents and what security teams need to do before the next wave hits.
## Summer Expose Healthcare's Growing Ransomware Risk
Hospitals can't afford downtime, and attackers know it.
This summer, ransomware groups targeted healthcare, exploiting both the value of patient data and the urgency of care.
## Interlock rises as a major th
Bleepingcomputer
Ransomware gangs join attacks targeting Microsoft SharePoint servers
blogs_bleepingcomputer·2025-08-04·CVSS 8.8
[HIGH] Ransomware gangs join attacks targeting Microsoft SharePoint servers
## Ransomware gangs join attacks targeting Microsoft SharePoint servers
## Sergiu Gatlan
The loader was spotted following a failed exploitation attempt that revealed malicious PowerShell commands designed to disable security monitoring on the targeted device.
"Analysis of the 4L4MD4R payload revealed that it is UPX-packed and written in GoLang. Upon execution, the sample decrypts an AES-encrypted payload in memory, allocates memory to load the decrypted PE file, and creates a new thread to execute it," Unit 42 said .
The 4L4MD4R ransomware encrypts files on the compromised system and demands a payment of 0.005 Bitcoin, generating ransom notes and encrypted file lists on infected systems.
Microsoft and Google have also linked the ToolShell attacks to Chinese threat actors, with Micros
Checkpoint
Before ToolShell: Exploring Storm-2603’s Previous Ransomware Operations
blogs_checkpoint·2025-07-31
CVE-2025-49704 Before ToolShell: Exploring Storm-2603’s Previous Ransomware Operations
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## Before ToolShell: Exploring Storm-2603’s Previous Ransomware Operations
## Key Findings
Check Point Research (CPR) conducted a focused analysis of Storm-2603 , a threat actor associated
Unit42
Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12)
blogs_unit42·2025-07-31·CVSS 8.8
CVE-2025-49704 [HIGH] Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12)
Threat Research Center
High Profile Threats
Vulnerabilities
## Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12)
Unit 42
Published: July 31, 2025
High Profile Threats
Vulnerabilities
CL-CRI-1040
CVE-2025-49704
CVE-2025-49706
CVE-2025-53770
CVE-2025-53771
Microsoft
SharePoint
Zero-day
## Executive Summary
Unit 42 stopped monitoring this threat and updating the brief on Sept. 18, 2025. Please refer to the Microsoft SharePoint customer guidance for the latest information.
Update July 31, 2025
An investigation into ToolShell exploitation revealed the deployment of 4L4MD4R ransomware, a variant of the open-source Mauri870 ransomware.
A failed exploitation attempt on July 27, 2025, involving an encoded PowerShell command, led
Unit42
Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12)
blogs_unit42·2025-07-31·CVSS 8.8
CVE-2025-49704 [HIGH] Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12)
## Executive Summary
Unit 42 stopped monitoring this threat and updating the brief on Sept. 18, 2025. Please refer to the Microsoft SharePoint customer guidance for the latest information.
Update July 31, 2025
An investigation into ToolShell exploitation revealed the deployment of 4L4MD4R ransomware, a variant of the open-source Mauri870 ransomware.
A failed exploitation attempt on July 27, 2025, involving an encoded PowerShell command, led to the discovery of a loader designed to download and execute the ransomware from hxxps://ice.theinnovationfactory[.]it/static/4l4md4r.exe (145.239.97[.]206).
The PowerShell command attempted to disable real-time monitoring and bypass certificate validation. Full details are in the Scope of Attack section.
Update July 29, 2025
Unit 42 telemetr
Checkpoint
28th July – Threat Intelligence Report
blogs_checkpoint·2025-07-28·CVSS 9.8
CVE-2025-53770 [CRITICAL] 28th July – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 28th July – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 28th July, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
The US Energy Department, including its National Nuclear Security Administration (NNSA), was reportedly breached as part of a Microsoft SharePoint vulnerability exploit. The breach was linked to a broader espionage campaign, that targeted government agencies via the CVE-2025-53770 The extent of the intrusion and data compromise
Schneier
Microsoft SharePoint Zero-Day
blogs_schneier·2025-07-28·CVSS 9.8
CVE-2025-53770 [CRITICAL] Microsoft SharePoint Zero-Day
## Microsoft SharePoint Zero-Day
Chinese hackers are exploiting a high-severity vulnerability in Microsoft SharePoint to steal data worldwide:
The vulnerability, tracked as CVE-2025-53770, carries a severity rating of 9.8 out of a possible 10. It gives unauthenticated remote access to SharePoint Servers exposed to the Internet. Starting Friday, researchers began warning of active exploitation of the vulnerability, which affects SharePoint Servers that infrastructure customers run in-house. Microsoft’s cloud-hosted SharePoint Online and Microsoft 365 are not affected.
Here’s Microsoft on patching instructions. Patching isn’t enough, as attackers have used the vulnerability to steal authentication credentials. It’s an absolute mess. CISA has more information . Also these four links . Two
Securelist
ToolShell: a story of five vulnerabilities in Microsoft SharePoint
blogs_securelist·2025-07-25·CVSS 7.8
CVE-2025-49706 [HIGH] ToolShell: a story of five vulnerabilities in Microsoft SharePoint
Table of Contents
- The exploit
- CVE-2025-49706
- CVE-2025-53771
- CVE-2025-49704
- CVE-2025-53770
- CVE-2020-1147
- Conclusions
Authors
- Boris Larin
- Georgy Kucherin
- Ilya Savelyev
On July 19–20, 2025, various security companies and national CERTs published alerts about active exploitation of on-premise SharePoint servers. According to the reports, observed attacks did not require authentication, allowed attackers to gain full control over the infected servers, and were performed using an exploit chain of two vulnerabilities: CVE-2025-49704 and CVE-2025-49706, publicly named “ToolShell”. Additionally, on the same dates, Microsoft released out-of-band security patches for the vulnerabilities CVE-2025-53770 and CVE-2025-53771, aimed at addressing the security bypasses of previously
Fortinet
Inside The ToolShell Campaign | FortiGuard Labs
blogs_fortinet·2025-07-25·CVSS 8.8
[HIGH] Inside The ToolShell Campaign | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
Inside The ToolShell Campaign
New “ToolShell” Exploit Chain Targets Unpatched and Zero-Day SharePoint Vulnerabilities for Remote Code Execution
FORTIGUARD SECURITY PORTFOLIO 2025 THREAT LANDSCAPE REPORT
Probing Action
GhostWebShell
KeySiphon
Conclusion
Fortinet Protections
IOCs
By Cara Lin | July 25, 2025
Affected Platforms: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition
Impacted Users: Any organization
Impact: Remote attackers gain control of the vulnerable systems
Severity Level: Critical
FortiGuard Labs is currently tracking multiple threat actors targeting on-premises Microsoft SharePoint servers. This attack leverages a newly identified exploit chain dubbed "ToolS
Securelist
ToolShell: a story of five vulnerabilities in Microsoft SharePoint
blogs_securelist·2025-07-25·CVSS 7.8
CVE-2025-49706 [HIGH] ToolShell: a story of five vulnerabilities in Microsoft SharePoint
Table of Contents
The exploit
CVE-2025-49706
CVE-2025-53771
CVE-2025-49704
CVE-2025-53770
CVE-2020-1147
Conclusions
Authors
Boris Larin
Georgy Kucherin
Ilya Savelyev
On July 19–20, 2025, various security companies and national CERTs published alerts about active exploitation of on-premise SharePoint servers. According to the reports, observed attacks did not require authentication, allowed attackers to gain full control over the infected servers, and were performed using an exploit chain of two vulnerabilities: CVE-2025-49704 and CVE-2025-49706 , publicly named “ToolShell”. Additionally, on the same dates, Microsoft released out-of-band security patches for the vulnerabilities CVE-2025-53770 and CVE-2025-53771 , aimed at addressing the security bypasses of previously issued fix
Tenable
Cybersecurity Snapshot: SharePoint Attacks Trigger Urgent Patching Calls, While U.S. Gov’t Unveils AI Innovation Plan
blogs_tenable·2025-07-25
Cybersecurity Snapshot: SharePoint Attacks Trigger Urgent Patching Calls, While U.S. Gov’t Unveils AI Innovation Plan
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
BRB, pausing for a "Sanctuary Moon" marathon
blogs_talos·2025-07-24
BRB, pausing for a "Sanctuary Moon" marathon
## BRB, pausing for a "Sanctuary Moon" marathon
Welcome to this week’s edition of the Threat Source newsletter.
Yesterday, Cisco Talos debuted the first Humans of Talos episode , where I interviewed Hazel Burton, a face and voice you’re probably familiar with. In our conversation, Hazel shared not just the story of how she found her way onto the team, but also the passions and hobbies that energize her work. Plus, she offered a sneak peek into what she’s most looking forward to at Black Hat this year! With future Humans of Talos episodes, you’ll get to learn not only about the people behind the research, but the people behind the communications, operations, and design, too.
My team chose to name the series “Humans of Talos” as a cheeky wink to the world of machine learning (ML) and a re
Bleepingcomputer
Microsoft: SharePoint flaws exploited in Warlock ransomware attacks
blogs_bleepingcomputer·2025-07-24·CVSS 8.8
[HIGH] Microsoft: SharePoint flaws exploited in Warlock ransomware attacks
## Microsoft: SharePoint flaws exploited in Warlock ransomware attacks
## Sergiu Gatlan
"Starting on July 18, 2025, Microsoft has observed Storm-2603 deploying ransomware using these vulnerabilities."
After breaching the victims' networks, Storm-2603 operators use the Mimikatz hacking tool to extract plaintext credentials from LSASS memory.
They then move laterally with PsExec and the Impacket toolkit, executing commands via Windows Management Instrumentation (WMI), and modifying Group Policy Objects (GPOs) to deliver Warlock ransomware across compromised systems.
"Customers should apply the on-premises SharePoint Server security updates immediately and follow the detailed mitigation guidance in our blog," Microsoft also warned .
Microsoft Threat Intelligence researchers have also li
Talos
BRB, pausing for a "Sanctuary Moon" marathon
blogs_talos·2025-07-24
BRB, pausing for a "Sanctuary Moon" marathon
Welcome to this week’s edition of the Threat Source newsletter.
Yesterday, Cisco Talos debuted the first Humans of Talos episode, where I interviewed Hazel Burton, a face and voice you’re probably familiar with. In our conversation, Hazel shared not just the story of how she found her way onto the team, but also the passions and hobbies that energize her work. Plus, she offered a sneak peek into what she’s most looking forward to at Black Hat this year! With future Humans of Talos episodes, you’ll get to learn not only about the people behind the research, but the people behind the communications, operations, and design, too.
My team chose to name the series “Humans of Talos” as a cheeky wink to the world of machine learning (ML) and a reminder that no matter how sophisticated our techno
Bleepingcomputer
US nuclear weapons agency hacked in Microsoft SharePoint attacks
blogs_bleepingcomputer·2025-07-23
US nuclear weapons agency hacked in Microsoft SharePoint attacks
## US nuclear weapons agency hacked in Microsoft SharePoint attacks
## Sergiu Gatlan
Unknown threat actors have breached the National Nuclear Security Administration's network in attacks exploiting a recently patched Microsoft SharePoint zero-day vulnerability chain.
NNSA is a semi-autonomous U.S. government agency part of the Department of Energy that maintains the country's nuclear weapons stockpile and is also tasked with responding to nuclear and radiological emergencies within the United States and abroad.
A Department of Energy spokesperson confirmed in a statement that hackers gained access to NNSA networks last week.
"On Friday, July 18th, the exploitation of a Microsoft SharePoint zero-day vulnerability began affecting the Department of Energy, including the NNSA," Department
Sentinelone
Defending Against ToolShell: SharePoint’s Latest Critical Vulnerability
blogs_sentinelone·2025-07-23·CVSS 9.8
CVE-2025-53770 [CRITICAL] Defending Against ToolShell: SharePoint’s Latest Critical Vulnerability
A new, critical zero-day vulnerability dubbed “ToolShell” (CVE-2025-53770) poses a significant threat to on-premises SharePoint Server deployments. This vulnerability enables unauthenticated remote code execution (RCE), posing a significant risk to organizations worldwide. SentinelOne has detected exploitation in the wild, elevating the active threat posed by this new attack and the importance of organizations taking mitigative action as soon as possible.
In this blog, we outline ways to defend against ToolShell and how SentinelOne keeps you ahead of the curve for this critical vulnerability. For a comprehensive technical breakdown of this threat, we published a detailed analysis on the SentinelOne blog.
## What is ToolShell?
ToolShell is a critical zero-day remote code execution vulner
Sentinelone
Defending Against ToolShell: SharePoint’s Latest Critical Vulnerability
blogs_sentinelone·2025-07-23·CVSS 9.8
CVE-2025-53770 [CRITICAL] Defending Against ToolShell: SharePoint’s Latest Critical Vulnerability
A new, critical zero-day vulnerability dubbed “ToolShell” ( CVE-2025-53770 ) poses a significant threat to on-premises SharePoint Server deployments. This vulnerability enables unauthenticated remote code execution (RCE), posing a significant risk to organizations worldwide. SentinelOne has detected exploitation in the wild, elevating the active threat posed by this new attack and the importance of organizations taking mitigative action as soon as possible .
In this blog, we outline ways to defend against ToolShell and how SentinelOne keeps you ahead of the curve for this critical vulnerability. For a comprehensive technical breakdown of this threat, we published a detailed analysis on the SentinelOne blog .
## What is ToolShell?
ToolShell is a critical zero-day remote code execution vu
Trendmicro
Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
blogs_trendmicro·2025-07-22·CVSS 9.8
CVE-2025-53770 [CRITICAL] Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
Exploits & Vulnerabilities
## Proactive Security Insights for SharePoint Attacks (CVE-2025-53770 and CVE-2025-53771)
CVE-2025-53770 and CVE-2025-53771 are vulnerabilities in on-premise Microsoft SharePoint Servers that evolved from previously patched flaws, allowing unauthenticated remote code execution through advanced deserialization and ViewState abuse.
By: Trend Micro Research Jul 22, 2025 Read time: ( words)
Save to Folio
Table 1. Summary of the MITRE ATT&CK tools, tactics, and procedures used in attacks that exploit CVE-2025-53770 and CVE-2025-53771
Bleepingcomputer
Microsoft links Sharepoint ToolShell attacks to Chinese hackers
blogs_bleepingcomputer·2025-07-22·CVSS 8.8
[HIGH] Microsoft links Sharepoint ToolShell attacks to Chinese hackers
## Microsoft links Sharepoint ToolShell attacks to Chinese hackers
## Sergiu Gatlan
"We assess that at least one of the actors responsible for this early exploitation is a China-nexus threat actor. It's critical to understand that multiple actors are now actively exploiting this vulnerability," Charles Carmakal, CTO of Google Cloud's Mandiant Consulting, told BleepingComputer yesterday.
On Friday, Dutch cybersecurity firm Eye Security first spotted zero-day attacks exploiting the CVE-2025-49706 and CVE-2025-49704 vulnerabilities (first demoed during the Berlin Pwn2Own hacking contest by Viettel Cyber Security researchers).
The company told BleepingComputer that at least 54 organizations had already been compromised, including several multinational companies and national government enti
Trendmicro
Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
blogs_trendmicro·2025-07-22·CVSS 9.8
CVE-2025-53770 [CRITICAL] Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
Exploits & Vulnerabilities
## Proactive Security Insights for SharePoint Attacks (CVE-2025-53770 and CVE-2025-53771)
CVE-2025-53770 and CVE-2025-53771 are vulnerabilities in on-premise Microsoft SharePoint Servers that evolved from previously patched flaws, allowing unauthenticated remote code execution through advanced deserialization and ViewState abuse.
By: Trend Micro Research 2025/07/22 Read time: ( words)
Save to Folio
Table 1. Summary of the MITRE ATT&CK tools, tactics, and procedures used in attacks that exploit CVE-2025-53770 and CVE-2025-53771
Microsoft
Disrupting active exploitation of on-premises SharePoint vulnerabilities
blogs_microsoft·2025-07-22
Disrupting active exploitation of on-premises SharePoint vulnerabilities
Research
July 22, 2025
## Microsoft Sentinel
Microsoft Sentinel customers can use the TI Mapping analytics (a series of analytics all prefixed with ‘TI map’) to automatically match the malicious domain indicators mentioned in this blog post with data in their workspace. If the TI Map analytics are not currently deployed, customers can install the Threat Intelligence solution from the Microsoft Sentinel Content Hub to have the analytics rule deployed in their Sentinel workspace.
Our post on web shell threat hunting with Microsoft Sentinel also provides guidance on looking for web shells in general. Several hunting queries are also available below:
Web shell detection
Possible Webshell drop
Malicious web application requests linked with Microsoft Defender for Endpoint alerts
Web sh
Trendmicro
Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
blogs_trendmicro·2025-07-22·CVSS 9.8
CVE-2025-53770 [CRITICAL] Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
Exploits y vulnerabilidades
## Proactive Security Insights for SharePoint Attacks (CVE-2025-53770 and CVE-2025-53771)
CVE-2025-53770 and CVE-2025-53771 are vulnerabilities in on-premise Microsoft SharePoint Servers that evolved from previously patched flaws, allowing unauthenticated remote code execution through advanced deserialization and ViewState abuse.
By: Trend Micro Research Jul 22, 2025 Read time: ( words)
Save to Folio
Table 1. Summary of the MITRE ATT&CK tools, tactics, and procedures used in attacks that exploit CVE-2025-53770 and CVE-2025-53771
Trendmicro
Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
blogs_trendmicro·2025-07-22·CVSS 8.8
CVE-2025-53770 [HIGH] Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
Exploits & Vulnerabilities
# Proactive Security Insights for SharePoint Attacks (CVE-2025-53770 and CVE-2025-53771)
CVE-2025-53770 and CVE-2025-53771 are vulnerabilities in on-premise Microsoft SharePoint Servers that evolved from previously patched flaws, allowing unauthenticated remote code execution through advanced deserialization and ViewState abuse.
By: Trend Micro Research
2025/07/22
Read time: ( words)
Save to Folio
Key takeaways
- CVE-2025-53770 and CVE-2025-53771 are vulnerabilities affecting on-premise Microsoft SharePoint Servers, which enables an attacker to upload malicious files and extract cryptographic secrets.
- These vulnerabilities are evolutions of previously patched flaws (CVE-2025-49704 and CVE-2025-49706), for which initial vendor-provided remediation was inc
Trendmicro
Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
blogs_trendmicro·2025-07-22·CVSS 9.8
CVE-2025-53770 [CRITICAL] Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
Ausnutzung von Schwachstellen
## Proactive Security Insights for SharePoint Attacks (CVE-2025-53770 and CVE-2025-53771)
CVE-2025-53770 and CVE-2025-53771 are vulnerabilities in on-premise Microsoft SharePoint Servers that evolved from previously patched flaws, allowing unauthenticated remote code execution through advanced deserialization and ViewState abuse.
By: Trend Micro Research Jul 22, 2025 Read time: ( words)
Save to Folio
Table 1. Summary of the MITRE ATT&CK tools, tactics, and procedures used in attacks that exploit CVE-2025-53770 and CVE-2025-53771
Wiz
SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know | Wiz Blog
blogs_wiz·2025-07-21·CVSS 8.8
CVE-2025-53770 [HIGH] SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know | Wiz Blog
Microsoft has issued urgent guidance following the discovery of two zero-day vulnerabilities affecting on-premises Microsoft SharePoint servers, identified as CVE-2025-53770 and CVE-2025-53771. These vulnerabilities are actively being exploited in the wild.
# What are CVE-2025-53770 and CVE-2025-53771?
CVE-2025-53770 (CVSS 9.8) is a critical RCE vulnerability caused by unsafe deserialization of untrusted data in on-premises SharePoint Servers. This forms the execution stage of the “ToolShell” exploit chain.
CVE-2025-53771 (CVSS 6.3) is a spoofing vulnerability caused by a header spoofing vulnerability in SharePoint’s request handling. It allows attackers to bypass authentication by crafting a request that mimics a legitimate SharePoint workflow using a forged Referer header.
These vuln
Bleepingcomputer
Microsoft releases emergency patches for SharePoint RCE flaws exploited in attacks
blogs_bleepingcomputer·2025-07-21·CVSS 8.8
CVE-2025-53770 [HIGH] Microsoft releases emergency patches for SharePoint RCE flaws exploited in attacks
## Microsoft releases emergency patches for SharePoint RCE flaws exploited in attacks
## Lawrence Abrams
Using these flaws, the threat actors have been conducting ToolShell attacks on SharePoint servers worldwide , impacting over 54 organizations so far.
## Emergency updates released
Microsoft has now rushed out emergency out-of-band security updates for Microsoft SharePoint Subscription Edition, SharePoint 2019, and SharePoint 2016 that fix both the CVE-2025-53770 and CVE-2025-53771 flaws.
"Yes, the update for CVE-2025-53770 includes more robust protections than the update for CVE-2025-49704. The update for CVE-2025-53771 includes more robust protections than the update for CVE-2025-49706," reads a note in Microsoft advisories.
Microsoft SharePoint admins should install the followin
Talos
ToolShell: Details of CVEs affecting SharePoint servers
blogs_talos·2025-07-21·CVSS 8.8
CVE-2025-53770 [HIGH] ToolShell: Details of CVEs affecting SharePoint servers
## ToolShell: Details of CVEs affecting SharePoint servers
Update 2025/07/22: Microsoft has released a security update for Sharepoint Enterprise Server 2016. The update, with the ID KB5002760, is available in the following link .
Cisco Talos is aware of the ongoing exploitation of CVE-2025-53770 and CVE-2025-53771 in the wild. These are path traversal vulnerabilities affecting SharePoint Server Subscription Edition, SharePoint Server 2016, and SharePoint Server 2019. According to Microsoft, these vulnerabilities do not affect SharePoint Online in Microsoft 365 and only apply to on-premises SharePoint servers.
Microsoft has also released security updates and mitigation guidance for multiple affected products. The update for Sharepoint Server 2016 has also been released .
These two vulne
Krebs
Microsoft Fix Targets Attacks on SharePoint Zero-Day
blogs_krebs·2025-07-21·CVSS 6.5
CVE-2025-53770 [MEDIUM] Microsoft Fix Targets Attacks on SharePoint Zero-Day
On Sunday, July 20, Microsoft Corp. issued an emergency security update for a vulnerability in SharePoint Server that is actively being exploited to compromise vulnerable organizations. The patch comes amid reports that malicious hackers have used the SharePoint flaw to breach U.S. federal and state agencies, universities, and energy companies.
In an advisory about the SharePoint security hole, a.k.a. CVE-2025-53770, Microsoft said it is aware of active attacks targeting on-premises SharePoint Server customers and exploiting vulnerabilities that were only partially addressed by the July 8, 2025 security update.
The Cybersecurity & Infrastructure Security Agency (CISA) concurred, saying CVE-2025-53770 is a variant on a flaw Microsoft patched earlier this month (CVE-2025-49706). Microsoft
Sentinelone
SharePoint ToolShell | Zero-Day Exploited in-the-Wild Targets Enterprise Servers
blogs_sentinelone·2025-07-21
SharePoint ToolShell | Zero-Day Exploited in-the-Wild Targets Enterprise Servers
On July 19th, Microsoft confirmed that a 0-day vulnerability impacting on-premises Microsoft SharePoint Servers, dubbed “ToolShell” (by researcher Khoa Dinh @_l0gg), was being actively exploited in the wild. This flaw has since been assigned the identifier CVE‑2025‑53770, along with an accompanying bypass tracked as CVE‑2025‑53771. These two new CVEs are being used alongside the previously patched CVEs (49704/49706) which were patched on July 8th, with PoC code surfacing by July 14th.
The advisory also confirmed emergency patches for on-prem SharePoint Subscription Edition and SharePoint Server 2019, with updates scheduled for version 2016 as well. We strongly recommend immediate patching, and following Microsoft’s recommendations of enabling AMSI detection, rotating ASP.NET machine keys,
Wiz
SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know | Wiz Blog
blogs_wiz·2025-07-21·CVSS 8.8
CVE-2025-53770 [HIGH] SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know | Wiz Blog
Microsoft has issued urgent guidance following the discovery of two zero-day vulnerabilities affecting on-premises Microsoft SharePoint servers, identified as CVE-2025-53770 and CVE-2025-53771. These vulnerabilities are actively being exploited in the wild.
## What are CVE-2025-53770 and CVE-2025-53771?
CVE-2025-53770 (CVSS 9.8) is a critical RCE vulnerability caused by unsafe deserialization of untrusted data in on-premises SharePoint Servers. This forms the execution stage of the “ToolShell” exploit chain.
CVE-2025-53771 (CVSS 6.3) is a spoofing vulnerability caused by a header spoofing vulnerability in SharePoint’s request handling. It allows attackers to bypass authentication by crafting a request that mimics a legitimate SharePoint workflow using a forged Referer header.
These vul
Qualys
ToolShell Zero-day: Microsoft Rushes Emergency Patch for Actively Exploited SharePoint Vulnerabilities | Qualys
blogs_qualys·2025-07-21·CVSS 9.8
CVE-2025-53770 [CRITICAL] ToolShell Zero-day: Microsoft Rushes Emergency Patch for Actively Exploited SharePoint Vulnerabilities | Qualys
#### Table of Contents
- CVE-2025-53770: Critical Remote Code Execution
- CVE-2025-53771: Server Spoofing Vulnerability
- History of the Vulnerabilities
- Who is Affected?
- Qualys QID Coverage
- Eliminating Risk of these Vulnerabilities with the Qualys Enterprise TruRiskTM Platform
On July 19, 2025, Microsoft issued an emergency out-of-band security update to address two zero-day vulnerabilities in Microsoft SharePoint Server: CVE-2025-53770 and CVE-2025-53771. These vulnerabilities are under active exploitation in the wild and demand immediate attention to protect your on-premises SharePoint environments.
## CVE-2025-53770: Critical Remote Code Execution
The first of the two vulnerabilities, CVE-2025-53770, is a critical-severity vulnerability with a CVSS score of 9.8 out of 10. Succ
Zscaler
CVE-2025-53770 | ThreatLabz
blogs_zscaler·2025-07-21·CVSS 9.8
[CRITICAL] CVE-2025-53770 | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Krebs
Microsoft Fix Targets Attacks on SharePoint Zero-Day
blogs_krebs·2025-07-21·CVSS 6.5
CVE-2025-53770 [MEDIUM] Microsoft Fix Targets Attacks on SharePoint Zero-Day
On Sunday, July 20, Microsoft Corp. issued an emergency security update for a vulnerability in SharePoint Server that is actively being exploited to compromise vulnerable organizations. The patch comes amid reports that malicious hackers have used the SharePoint flaw to breach U.S. federal and state agencies, universities, and energy companies.
Image: Shutterstock, by Ascannio.
In an advisory about the SharePoint security hole, a.k.a. CVE-2025-53770 , Microsoft said it is aware of active attacks targeting on-premises SharePoint Server customers and exploiting vulnerabilities that were only partially addressed by the July 8, 2025 security update .
The Cybersecurity & Infrastructure Security Agency (CISA) concurred , saying CVE-2025-53770 is a variant on a flaw Microsoft patched earlier t
Qualys
ToolShell Zero-day: Microsoft Rushes Emergency Patch for Actively Exploited SharePoint Vulnerabilities
blogs_qualys·2025-07-21·CVSS 9.8
CVE-2025-53770 [CRITICAL] ToolShell Zero-day: Microsoft Rushes Emergency Patch for Actively Exploited SharePoint Vulnerabilities
## Table of Contents
CVE-2025-53770: Critical Remote Code Execution
CVE-2025-53771: Server Spoofing Vulnerability
History of the Vulnerabilities
Who is Affected?
Qualys QID Coverage
Eliminating Risk of these Vulnerabilities with the Qualys Enterprise TruRiskTM Platform
On July 19, 2025, Microsoft issued an emergency out-of-band security update to address two zero-day vulnerabilities in Microsoft SharePoint Server: CVE-2025-53770 and CVE-2025-53771. These vulnerabilities are under active exploitation in the wild and demand immediate attention to protect your on-premises SharePoint environments.
## CVE-2025-53770: Critical Remote Code Execution
The first of the two vulnerabilities, CVE-2025-53770, is a critical-severity vulnerability with a CVSS score of 9.8 out of 10. Successful ex
Talos
ToolShell: Details of CVEs affecting SharePoint servers
blogs_talos·2025-07-21·CVSS 8.8
CVE-2025-53770 [HIGH] ToolShell: Details of CVEs affecting SharePoint servers
Update 2025/07/22: Microsoft has released a security update for Sharepoint Enterprise Server 2016. The update, with the ID KB5002760, is available in the following link.
Cisco Talos is aware of the ongoing exploitation of CVE-2025-53770 and CVE-2025-53771 in the wild. These are path traversal vulnerabilities affecting SharePoint Server Subscription Edition, SharePoint Server 2016, and SharePoint Server 2019. According to Microsoft, these vulnerabilities do not affect SharePoint Online in Microsoft 365 and only apply to on-premises SharePoint servers.
Microsoft has also released security updates and mitigation guidance for multiple affected products. The update for Sharepoint Server 2016 has also been released.
These two vulnerabilities, CVE-2025-53770 / CVE-2025-53771, are related to CV
Checkpoint
21st July – Threat Intelligence Report
blogs_checkpoint·2025-07-21
CVE-2025-53770 21st July – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 21st July – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 21st July, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
Luxury retailer Louis Vuitton has suffered a cyber-attack that resulted in the exfiltration of certain personal data of customers from the UK, South Korea, Turkey , Italy, and Sweden after unauthorized access to its systems. No payment information was compromised, but sensitive client data was exposed, reportedly due to a breac
Bleepingcomputer
Microsoft SharePoint zero-day exploited in RCE attacks, no patch available
blogs_bleepingcomputer·2025-07-20·CVSS 8.8
CVE-2025-53770 [HIGH] Microsoft SharePoint zero-day exploited in RCE attacks, no patch available
## Microsoft SharePoint zero-day exploited in RCE attacks, no patch available
## Lawrence Abrams
While Microsoft patched both ToolShell flaws as part of the July Patch Tuesday , it is now warning that threat actors were able to bypass the fixes with new exploits.
These new vulnerabilities are tracked as CVE-2025-53770 (bypasses CVE-2025-49704) and CVE-2025-53771 (CVE-2025-49706), and are actively exploited attacks against on-premise SharePoint servers.
"Microsoft is aware of active attacks targeting on-premises SharePoint Server customers by exploiting vulnerabilities partially addressed by the July Security Update," warns a new Microsoft blog post .
"These vulnerabilities apply to on-premises SharePoint Servers only. SharePoint Online in Microsoft 365 is not impacted."
Microsoft has
Tenable
CVE-2025-53770: Frequently Asked Questions About Zero-Day SharePoint Vulnerability Exploitation
blogs_tenable·2025-07-20·CVSS 9.8
[CRITICAL] CVE-2025-53770: Frequently Asked Questions About Zero-Day SharePoint Vulnerability Exploitation
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
Zero-Day Vulnerability Protection | Detect & Stop Threats | Qualys
blogs_qualys·2025-04-18
Zero-Day Vulnerability Protection | Detect & Stop Threats | Qualys
## Table of Contents
Why Zero-Day Vulnerabilities Demand a New Security Mindset
Understanding Zero-Day Vulnerabilities, Exploits, and Attacks
How Do Zero-Day Attacks Work?
The Zero-Day Lifecycle: From Discovery to Exploitation
Real-World Zero-Day Attacks and Their Impact
Why Zero-Day Vulnerabilities Are So Dangerous
Detecting Zero-Day Vulnerabilities
Challenges in Identifying Zero-Day Vulnerabilities
How Qualys Helps Organizations Manage Zero-Day Risk
Conclusion
Frequently Asked Questions (FAQs)
Executive Summary
Zero-day vulnerabilities pose a significant and growing risk as opportunistic attackers rapidly exploit unknown flaws before fixes are available. These threats can bypass traditional defenses, spread rapidly, and cause widespread disruption across organizations.
To r
Qualys
Zero-Day Vulnerability Protection | Detect & Stop Threats | Qualys
blogs_qualys·2025-04-18
Zero-Day Vulnerability Protection | Detect & Stop Threats | Qualys
#### Table of Contents
- Why Zero-Day Vulnerabilities Demand a New Security Mindset
- Understanding Zero-Day Vulnerabilities, Exploits, and Attacks
- How Do Zero-Day Attacks Work?
- The Zero-Day Lifecycle: From Discovery to Exploitation
- Real-World Zero-Day Attacks and Their Impact
- Why Zero-Day Vulnerabilities Are So Dangerous
- Detecting Zero-Day Vulnerabilities
- Challenges in Identifying Zero-Day Vulnerabilities
- How Qualys Helps Organizations Manage Zero-Day Risk
- Conclusion
- Frequently Asked Questions (FAQs)
Executive Summary
Zero-day vulnerabilities pose a significant and growing risk as opportunistic attackers rapidly exploit unknown flaws before fixes are available. These threats can bypass traditional defenses, spread rapidly, and cause widespread disruption across organi
Trendmicro
Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
blogs_trendmicro·CVSS 9.8
CVE-2025-53770 [CRITICAL] Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
## Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
CVE-2025-53770 and CVE-2025-53771 are vulnerabilities in on-premise Microsoft SharePoint Servers that evolved from previously patched flaws, allowing unauthenticated remote code execution through advanced deserialization and ViewState abuse.
By: Trend Micro April 03, 2026 Read time: ( words)
Save to Folio
Zscaler
CXO Monthly Roundup, July 2025: Ransomware Report, China-Nexus APT Analysis, SharePoint Security with Zero Trust, and More | CXO Revolutionaries
blogs_zscaler
CXO Monthly Roundup, July 2025: Ransomware Report, China-Nexus APT Analysis, SharePoint Security with Zero Trust, and More | CXO Revolutionaries
TOP STORY
## CXO Monthly Roundup, July 2025: Ransomware Report, China-Nexus APT Analysis, SharePoint Security with Zero Trust, and More
Deepen Desai
Contributor
Zscaler
## Aug 14, 2025
Highlights from the Zscaler ThreatLabz team's July 2025 research.
The CXO Monthly Roundup provides the latest ThreatLabz research, alongside insights on other cyber-related subjects that matter to technology executives. This July edition highlights three major developments: the release of the Zscaler ThreatLabz 2025 Ransomware Report, a detailed analysis of nation-state attacks targeting the Tibetan community, and how Zscaler Deception proactively intercepted exploitation attempts targeting SharePoint servers, providing organizations with critical early warnings days ahead of public advisories. In add
Huntress
Velociraptor Misuse, Pt. II: The Eye of the Storm | Huntress
blogs_huntress
Velociraptor Misuse, Pt. II: The Eye of the Storm | Huntress
Acknowledgements: Special thanks to Ben Folland, Anna Pham, Michael Tigges, and Anton Ovrutsky for contributing to this investigation and writeup.
We recently outlined an incident on November 12 where threat actors exploited a vulnerability in Windows Server Update Services (WSUS) before installing a legitimate open source tool called Velociraptor. Velociraptor is a digital forensics and incident response (DFIR) tool that we have seen threat actors abuse recently in attacks in order to set up command-and-control (C2) communications.
Beyond this most recent incident, the Huntress SOC investigated and reported three incidents through September and November that involved the threat actor installing Velociraptor and using it for C2 of impacted endpoints. Some of the top takeaways from these
Recorded Future
ToolShell Exploit: Critical SharePoint Zero-Day Threatens Global Enterprises
blogs_recorded_future·CVSS 9.8
CVE-2025-53770 [CRITICAL] ToolShell Exploit: Critical SharePoint Zero-Day Threatens Global Enterprises
# ToolShell Exploit Chain Puts Thousands of SharePoint Servers at Risk
A zero-day exploit chain called "ToolShell" is actively being used to target on-premises Microsoft SharePoint servers worldwide, potentially affecting thousands of organizations. The attack leverages two critical vulnerabilities (CVE-2025-53770 and CVE-2025-53771) to achieve remote code execution and steal cryptographic keys, giving attackers persistent access even after organizations apply patches.
These vulnerabilities apply to on-premises SharePoint Servers only. SharePoint Online in Microsoft 365 has not been impacted.
Read on to understand the ToolShell threat and how to defend against it with hunting packages, including Nuclei and YARA rules, from Recorded Future.
## The latest Tactics, Techniques, and Procedu
Trendmicro
Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
blogs_trendmicro·CVSS 8.8
CVE-2025-53770 [HIGH] Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
# Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
CVE-2025-53770 and CVE-2025-53771 are vulnerabilities in on-premise Microsoft SharePoint Servers that evolved from previously patched flaws, allowing unauthenticated remote code execution through advanced deserialization and ViewState abuse.
By: Trend Micro
September 22, 2025
Read time: ( words)
Save to Folio
Key takeaways
- CVE-2025-53770 and CVE-2025-53771 are vulnerabilities affecting on-premise Microsoft SharePoint Servers, which enables an attacker to upload malicious files and extract cryptographic secrets.
- These vulnerabilities are evolutions of previously patched flaws (CVE-2025-49704 and CVE-2025-49706), for which initial vendor-provided remediation was incomplete, enabling attackers to achieve
Recorded Future
ToolShell Exploit: Critical SharePoint Zero-Day Threatens Global Enterprises
blogs_recorded_future·CVSS 9.8
CVE-2025-53770 [CRITICAL] ToolShell Exploit: Critical SharePoint Zero-Day Threatens Global Enterprises
A zero-day exploit chain called "ToolShell" is actively being used to target on-premises Microsoft SharePoint servers worldwide, potentially affecting thousands of organizations. The attack leverages two critical vulnerabilities (CVE-2025-53770 and CVE-2025-53771) to achieve remote code execution and steal cryptographic keys, giving attackers persistent access even after organizations apply patches.
These vulnerabilities apply to on-premises SharePoint Servers only. SharePoint Online in Microsoft 365 has not been impacted.
Read on to understand the ToolShell threat and how to defend against it with hunting packages, including Nuclei and YARA rules, from Recorded Future.
## The latest Tactics, Techniques, and Procedures (TTPs)
On July 23, 2025, researchers at LeakIX shared details that
Trendmicro
Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
blogs_trendmicro·CVSS 9.8
CVE-2025-53770 [CRITICAL] Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
## Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks
CVE-2025-53770 and CVE-2025-53771 are vulnerabilities in on-premise Microsoft SharePoint Servers that evolved from previously patched flaws, allowing unauthenticated remote code execution through advanced deserialization and ViewState abuse.
By: Trend Micro September 22, 2025 Read time: ( words)
Save to Folio
Greynoiseio
NoiseLetter July 2025
blogs_greynoiseio
NoiseLetter July 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
arXiv
Uplifted Attackers, Human Defenders: The Cyber Offense-Defense Balance for Trailing-Edge Organizations
arxiv_fulltext·2025-08-14
Uplifted Attackers, Human Defenders: The Cyber Offense-Defense Balance for Trailing-Edge Organizations
-30pt
footnote0
## Abstract
Advances in artificial intelligence are widely understood to have implications for cybersecurity. Articles have emphasized the effect of AI on the cyber offense-defense balance, and credible commentators can be found arguing either that cyber will privilege attackers or defenders. For defenders, arguments are often made that AI will enable solutions like formal verification of all software—and for some well-equipped companies, this may be true. This conversation, however, does not match the reality for most companies. ``Trailing-edge organizations,'' as we term them, rely heavily on legacy software, poorly staff security roles, and struggle to implement best practices like rapid deployment of security patches. These decisions may be the result of corporate ine
ATT&CK
SharePoint ToolShell Exploitation
mitre_attack·CVSS 8.8
CVE-2025-49706 [HIGH] SharePoint ToolShell Exploitation
SharePoint ToolShell Exploitation
The [SharePoint ToolShell Exploitation](https://attack.mitre.org/campaigns/C0058) campaign was conducted in July 2025 and encompassed the first waves of exploitation against incompletely patched spoofing (CVE-2025-49706) and remote code execution (CVE-2025-49704) vulnerabilities affecting on-premises Microsoft SharePoint servers. Later patched and updated as CVE-2025-53770 and CVE-2025-53771, the ToolShell vulnerabilities were widely exploited including by China-based ransomware actor Storm-2603 and espionage actors [Threat Group-3390](https://attack.mitre.org/groups/G0027) and [ZIRCONIUM](https://attack.mitre.org/groups/G0128). [SharePoint ToolShell Exploitation](https://attack.mitre.org/campaigns/C0058) targeted multiple regions and industries including
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770https://arstechnica.com/security/2025/07/sharepoint-vulnerability-with-9-8-severity-rating-is-under-exploit-across-the-globe/https://github.com/kaizensecurity/CVE-2025-53770https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/https://news.ycombinator.com/item?id=44629710https://research.eye.security/sharepoint-under-siege/https://therecord.media/microsoft-sharepoint-zero-day-vulnerability-exploited-globallyhttps://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770https://www.darkreading.com/remote-workforce/microsoft-rushes-emergency-fix-exploited-sharepoint-toolshell-flawhttps://www.forbes.com/sites/daveywinder/2025/07/20/microsoft-confirms-ongoing-mass-sharepoint-attack---no-patch-available/https://x.com/Shadowserver/status/1946900837306868163https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53770
2025-07-20
Published
2025-07-20
Added to CISA KEV
Exploited in the wild