Sharepoint ToolShell Archives

The ToolShell vulnerability (CVE-2025-53770) in Microsoft SharePoint has been used by hackers thought to be connected to China in attacks on government agencies, academic institutions, telecom service providers, and financial institutions. The security issue affects on-premise SharePoint servers and was published as an actively exploited zero-day on July 20, after various hacking groups related to China used it in massive attacks. Microsoft delivered emergency upgrades the next day. The vulnerability is a workaround for CVE-2025-49706 and CVE-2025-49704, two vulnerabilities that researchers from Viettel Cyber Security had shown off at the Pwn2Own Berlin hacking competition in May. It may be used remotely without authentication to execute code and gain complete file system access. ...

A recent round of massive attacks targeting a Microsoft SharePoint zero-day vulnerability chain has implicated a number of hacker groups with connections to the Chinese government. After breaking into their on-premise SharePoint servers, they exploited this chain of exploits (named "ToolShell") to compromise dozens of companies throughout the globe. In a research released on Tuesday, Microsoft noted that it had seen two specific Chinese nation-state actors, Linen Typhoon and Violet Typhoon, take use of these flaws to target SharePoint systems that are accessible over the internet. Furthermore, we have seen that Storm-2603, a threat actor based in China, is taking advantage of these weaknesses. The use of these exploits by other actors is still being investigated. We conclude that...

Tag: Sharepoint ToolShell

Sharepoint ToolShell attacks targeted orgs across four continents

Microsoft links Sharepoint ToolShell attacks to Chinese hackers