An all-you-can-eat buffet for menace actors

ESET Analysis has been monitoring assaults involving the just lately found ToolShell zero-day vulnerabilities

24 Jul 2025
 • 
,
5 min. learn

On July 19^th, 2025, Microsoft confirmed {that a} set of zero-day vulnerabilities in SharePoint Server referred to as ToolShell is being exploited within the wild. ToolShell is comprised of CVE-2025-53770, a distant code execution vulnerability, and CVE‑2025‑53771, a server spoofing vulnerability. These assaults goal on-premises Microsoft SharePoint servers, particularly these operating SharePoint Subscription Version, SharePoint 2019, or SharePoint 2016. SharePoint On-line in Microsoft 365 shouldn’t be impacted. Exploiting these vulnerabilities allows menace actors to realize entry to restricted programs and steal delicate info.

Ranging from July 17^th, ToolShell has been extensively exploited by all types of menace actors, from petty cybercriminals to nation-state APT teams. Since SharePoint is built-in with different Microsoft companies, reminiscent of Workplace, Groups, OneDrive, and Outlook, this compromise can present the attackers a staggering degree of entry throughout the affected community.

As a part of the assault, the menace actors typically chain collectively 4 vulnerabilities: the beforehand patched CVE‑2025‑49704 and CVE-2025-49706, alongside the already talked about CVE-2025-53770 and CVE-2025-53771. As of July 22, CVE‑2025‑53770 and CVE-2025-53771 have additionally been patched.

Webshell payloads

Exploiting ToolShell permits the attackers to bypass multi-factor authentication (MFA), and single sign-on (SSO). After getting contained in the focused server, attackers have been seen deploying malicious webshells to extract info from the compromised system. One of many scripts regularly used for this goal is known as spinstall0.aspx, which we monitor as MSIL/Webshell.JS.

Moreover, on July 22^nd, 2025, we noticed that attackers tried to deploy different easy ASP webshells able to executing attacker-supplied instructions by way of cmd.exe. These webshells have been deployed utilizing the next filenames: ghostfile346.aspx, ghostfile399.aspx, ghostfile807.aspx, ghostfile972.aspx, and ghostfile913.aspx.

ESET merchandise first detected an try to use a part of the execution chain – the Sharepoint/Exploit.CVE-2025-49704 vulnerability – on July 17^th in Germany. Nonetheless, as a result of this try was blocked, the ultimate webshell payload was not delivered to the focused system. The primary time we registered the payload itself was on July 18^th on a server in Italy. As seen in Determine 1, we have now since noticed lively ToolShell exploitation everywhere in the world, with the US (13.3% of assaults) being essentially the most focused nation in keeping with our telemetry information.

Assault monitoring

Our monitoring of the ToolShell assaults from July 17^th to July 22^nd revealed that they have been coming from the IP addresses proven in Desk 1 (all occasions are in UTC).

Desk 1. Attacker IP addresses

Determine 2 exhibits the timeline of the assaults coming from the three most lively IP addresses.

Concerningly, Microsoft has reported that a number of China-aligned menace actors have joined in on the exploitation makes an attempt. From our facet, we detected a backdoor related to LuckyMouse – a cyberespionage group that targets primarily governments, telecommunications firms, and worldwide organizations – on a machine in Vietnam focused by way of ToolShell. At this stage, it stays unclear whether or not the system had been beforehand compromised or if the backdoor was launched through the present assault.

Nonetheless, China-aligned APT teams have actually seized the chance so as to add the exploit chain to their arsenals: in keeping with our telemetry, the victims of the ToolShell assaults embody a number of high-value authorities organizations which have been long-standing targets of those teams.

For the reason that cat is out of the bag now, we anticipate many extra opportunistic attackers to make the most of unpatched programs. The exploit makes an attempt are ongoing and can absolutely proceed. Subsequently, in case you are utilizing SharePoint Server, the next is really helpful (as per steerage from Microsoft):

• use solely supported variations,
• apply the newest safety updates,
• make it possible for Antimalware Scan Interface is turned on and configured correctly, with an applicable cybersecurity resolution, and
• rotate SharePoint Server ASP.NET machine keys.

For any inquiries about our analysis printed on WeLiveSecurity, please contact us at threatintel@eset.com. 

ESET Analysis affords non-public APT intelligence experiences and information feeds. For any inquiries about this service, go to the ESET Menace Intelligence web page.

IoCs

A complete checklist of indicators of compromise (IoCs) and samples might be present in our GitHub repository.

Recordsdata

Community

MITRE ATT&CK strategies

This desk was constructed utilizing model 17 of the MITRE ATT&CK framework.