2025Vulnerability exploitationEspionageRansomware
SharePoint ToolShell exploitation
From July 2025
Attackers exploited a chain of vulnerabilities in on-premises SharePoint Server, known as ToolShell (including CVE-2025-53770), to run code remotely and steal ASP.NET machine keys, which let them keep access even after patching. CISA added CVE-2025-53770 to its Known Exploited Vulnerabilities catalog on 20 July 2025. SharePoint Online was not affected.
- Victim
- Organisations running on-premises Microsoft SharePoint Server
- Sector
- Cross-sector, including government
- Public attribution
- Microsoft attributed exploitation to the Chinese nation-state actors Linen Typhoon and Violet Typhoon, and to a China-based actor it tracks as Storm-2603, which deployed ransomware.
Impact
Many internet-facing SharePoint servers were compromised; Microsoft said exploitation attempts began as early as 7 July 2025.
Root cause
Internet-facing on-premises collaboration servers with critical vulnerabilities, and stolen cryptographic keys that survived patching.
Lessons learned: the controls it teaches
- After patching an exploited server, rotate secrets such as machine keys and hunt for persistence.
- Enable anti-malware scanning integrations (AMSI) on web applications.
- Limit internet exposure of on-premises collaboration platforms.