Photo by Philip Oroni on Unsplash
So here’s the situation: a major security flaw in Microsoft SharePoint—used by over 400,000 organizations and 80% of Fortune 500 companies—is being actively exploited. And attackers aren’t just poking around. They’re fully inside networks, stealing data, planting backdoors, and bypassing even multi-factor authentication.
This wave of attacks has a name: ToolShell.
Let’s break down what’s happening, why it matters, and most importantly—what anyone running SharePoint on-premises needs to do right away.
What’s SharePoint and Why Is It a Big Deal?
SharePoint is Microsoft’s collaboration and document-sharing platform that’s been around since 2001. It’s used inside companies’ intranets—essentially their private internal internet—to manage important files and coordinate projects.
As of last year, Microsoft said more than 400,000 organizations used it. It’s not some obscure tool—it’s a bedrock of corporate operations around the world. That’s why a major hack here is serious business.
The Vulnerability: CVE-2025-53770
The technical name is CVE-2025-53770. It allows unauthenticated remote code execution. That means an outside attacker can run their own malicious code on a vulnerable SharePoint Server without needing a password, an account, or any special access.
Security folks gave it a severity score of 9.8 out of 10. That’s basically as bad as it gets.
Photo by Moritz Kindler on Unsplash
Discovered and confirmed under active exploitation last Saturday by security firm Eye Security, the attacks have been aggressive and global. They started at least as early as July 7.
Eye Security said the number of compromised systems jumped from dozens to at least 400 by midweek.
Who’s Behind the Attacks?
According to Microsoft, at least three groups connected to the Chinese government are exploiting the flaw:
- Linen Typhoon is reportedly focused on stealing intellectual property.
- Violet Typhoon leans toward traditional espionage methods.
- Storm-2603 is the new name on the list. While less is known about them, they’ve been linked to past ransomware attacks.
That said, it’s not guaranteed that only these groups are exploiting the bug. Others—possibly from different countries or criminal networks—might be involved too.
Why “ToolShell”?
The name comes from a previous exploit from a hacking competition back in May called Pwn2Own Berlin.
A security researcher named Dinh Ho Anh from Viettel Cyber Security created a proof-of-concept exploit that relied on a SharePoint component called ToolPane.aspx. That’s where “ToolShell” comes from.
The original pair of vulnerabilities—CVE-2025-49706 and CVE-2025-49704—were supposedly patched by Microsoft. But as it turns out, the fix was incomplete. That opened the door to the current wave of ToolShell attacks.
What Attackers Are Actually Doing
These aren’t just drive-by hacks.
They’re uploading malicious scripts with names like spinstall0.aspx, spinstall1.aspx, etc. These scripts:
- Steal machine-specific encryption keys used by SharePoint
- Harvest login tokens and credentials
- Bypass MFA and single sign-on protections
- Install persistent backdoors for long-term access
- Exfiltrate sensitive internal data
In short: attackers are burrowing deep, staying hidden, and making it very hard to kick them out once they’re in.
How to Know if You’re Affected
First, this only impacts organizations running SharePoint on internal servers—not the cloud-hosted version from Microsoft 365.
But if you do run SharePoint internally, it’s time to act fast:
Here’s what you should do:
- Apply Microsoft’s emergency patch released on Saturday, July 20. If you haven’t already, stop what you’re doing and install it.
- Scan your logs and systems for signs of compromise. This part is tricky, since the attack leaves few obvious traces at first.
- Check for indicators of compromise (IOCs) listed by:
- Microsoft Security Blog
- Eye Security
- U.S. Cybersecurity and Infrastructure Security Agency (CISA)
- Akamai, SentinelOne, Tenable, and Palo Alto Networks
Expect to spend time combing through server logs and verifying unusual web traffic, especially POST requests to ToolPane.aspx.
Photo by Markus Spiske on Unsplash
Final Thoughts
This isn’t another story about theoretical risks. ToolShell is out there, actively compromising some of the biggest organizations in the world—including, reportedly, even the U.S. National Nuclear Security Administration.
If your company runs its own SharePoint server, this is your call to action. Don’t wait until next week’s patch cycle. Update now. Inspect everything.
And if you’re not sure? Check anyway. When attackers can bypass MFA and stay hidden, it’s better to be paranoid than compromised.
—
Stay safe,
The Yugto.io Team
🛠️ SEO Keywords: SharePoint Vulnerability, ToolShell exploit, CVE-2025-53770, Microsoft SharePoint attack, ToolPane.aspx hack, Storm-2603, SharePoint zero day, on-premises SharePoint security, remote code execution exploit, Patch SharePoint server
