SharePoint ToolShell Exploitation

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. The SharePoint ToolShell Exploitation campaign was conducted in July 2025 and encompassed the first waves of exploitation against incompletely patched spoofing (CVE-2025-49706) and remote code execution (CVE-2025-49704) vulnerabilities affecting on-premises Microsoft SharePoint servers. Later patched and updated as CVE-2025-53770 and CVE-2025-53771, the ToolShell vulnerabilities were widely exploited including by China-based ransomware actor Storm-2603 and espionage actors Threat Group-3390 and ZIRCONIUM. SharePoint ToolShell Exploitation targeted multiple regions and industries including finance, education, energy, and healthcare across Asia, Europe, and the United States.(Citation: Microsoft SharePoint Exploit JUL 2025)(Citation: Palo Alto SharePoint Vulnerabilities JUL 2025)(Citation: Eye Research ToolShell JUL 2025)(Citation: ESET ToolShell JUL 2025)(Citation: Trend Micro SharePoint Attacks JUL 2025)

This is a historical record and does not establish current campaign activity.

Threat actor

Not established

Attribution confidence

Not established

First documented activity

2025-07-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2025-07-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2025-07-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1053.005 · Scheduled Task

  Execution, Persistence, Privilege Escalation — During SharePoint ToolShell Exploitation, threat actors used scheduled tasks to help establish persistence.(Citation: Microsoft SharePoint Exploit JUL 2025)

• T1033 · System Owner/User Discovery

  Discovery — During SharePoint ToolShell Exploitation, threat actors executed `whoami` on victim machines to enumerate user context and validate privilege levels.(Citation: Microsoft SharePoint Exploit JUL 2025)(Citation: SentinelOne ToolShell JUL 2025)

• T1552.001 · Credentials In Files

  Credential Access — During SharePoint ToolShell Exploitation, threat actors accessed web.config and machine.config to extract MachineKey values, enabling them to forge legitimate VIEWSTATE tokens for future deserialization payloads.(Citation: Microsoft SharePoint Exploit JUL 2025)(Citation: Eye Research ToolShell JUL 2025)(Citation: Trend Micro SharePoint Attacks JUL 2025)(Citation: SentinelOne ToolShell JUL 2025)(Citation: Palo Alto SharePoint Vulnerabilities JUL 2025)

• T1027.002 · Software Packing

  Stealth — During SharePoint ToolShell Exploitation, threat actors UPX-packed malicous payloads including 4L4MD4R ransomware.(Citation: Palo Alto SharePoint Vulnerabilities JUL 2025)

• T1071.001 · Web Protocols

  Command And Control — During SharePoint ToolShell Exploitation, threat actors issued HTTP `POST` requests to web shells with spoofed or empty Referrer headers, to circumvent authorization controls.(Citation: Microsoft SharePoint Exploit JUL 2025)(Citation: Eye Research ToolShell JUL 2025)(Citation: Trend Micro SharePoint Attacks JUL 2025)(Citation: SentinelOne ToolShell JUL 2025)(Citation: Palo Alto SharePoint Vulnerabilities JUL 2025)

• T1083 · File and Directory Discovery

  Discovery — During SharePoint ToolShell Exploitation, threat actors leveraged commands to locate accessible file shares, backup paths, or SharePoint content.(Citation: Microsoft SharePoint Exploit JUL 2025)

• T1505.003 · Web Shell

  Persistence — During SharePoint ToolShell Exploitation, threat actors followed exploitation of SharePoint servers with installation of a malicious .aspx web shell (spinstall0.aspx) that was written to the `_layouts/15/` directory, granting persistent HTTP-based access.(Citation: Microsoft SharePoint Exploit JUL 2025)(Citation: ESET ToolShell JUL 2025)(Citation: Eye Research ToolShell JUL 2025)(Citation: Trend Micro SharePoint Attacks JUL 2025)(Citation: SentinelOne ToolShell JUL 2025)(Citation: Palo Alto SharePoint Vulnerabilities JUL 2025)

• T1583.001 · Domains

  Resource Development — During SharePoint ToolShell Exploitation, threat actors registered C2 domains to spoof legitimate Microsoft domains.(Citation: Microsoft SharePoint Exploit JUL 2025)(Citation: Palo Alto SharePoint Vulnerabilities JUL 2025)

• T1140 · Deobfuscate/Decode Files or Information

  Stealth — During SharePoint ToolShell Exploitation, threat actors decrypted scripts prior to execution.(Citation: Palo Alto SharePoint Vulnerabilities JUL 2025)

• T1484.001 · Group Policy Modification

  Defense Impairment, Privilege Escalation — During SharePoint ToolShell Exploitation, threat actors, including Storm-2603, modified group policy to enable ransomware distribution.(Citation: Microsoft SharePoint Exploit JUL 2025)

• T1003.001 · LSASS Memory

  Credential Access — During SharePoint ToolShell Exploitation, threat actors used Mimikatz to dump LSASS memory.(Citation: Microsoft SharePoint Exploit JUL 2025)

• T1059.001 · PowerShell

  Execution — During SharePoint ToolShell Exploitation, threat actors used PowerShell to execute attacker-controlled encoded commands.(Citation: Microsoft SharePoint Exploit JUL 2025)(Citation: Eye Research ToolShell JUL 2025)(Citation: SentinelOne ToolShell JUL 2025)(Citation: Palo Alto SharePoint Vulnerabilities JUL 2025)

• T1657 · Financial Theft

  Impact — During SharePoint ToolShell Exploitation, threat actors demanded ransom payments to unencrypt filesystems and to refrain from publishing sensitive data exfiltrated from victim networks.(Citation: Palo Alto SharePoint Vulnerabilities JUL 2025)

• T1190 · Exploit Public-Facing Application

  Initial Access — During SharePoint ToolShell Exploitation, threat actors exploited authentication bypass and remote code execution vulnerabilities (CVE-2025-49706 and CVE-2025-49704) against on-premises SharePoint servers. This activity was characterized by crafted `POST` requests to the ToolPane endpoint `/_layouts/15/ToolPane.aspx`.(Citation: Microsoft SharePoint Exploit JUL 2025)(Citation: ESET ToolShell JUL 2025)(Citation: Eye Research ToolShell JUL 2025)(Citation: Trend Micro SharePoint Attacks JUL 2025)(Citation: SentinelOne ToolShell JUL 2025)(Citation: Palo Alto SharePoint Vulnerabilities JUL 2025)

• T1047 · Windows Management Instrumentation

  Execution — During SharePoint ToolShell Exploitation, threat actors used WMI for execution.(Citation: Microsoft SharePoint Exploit JUL 2025)

• T1119 · Automated Collection

  Collection — During SharePoint ToolShell Exploitation, threat actors used a command shell to automatically iterate through web.config files to expose and collect machineKey settings.(Citation: Trend Micro SharePoint Attacks JUL 2025)(Citation: Palo Alto SharePoint Vulnerabilities JUL 2025)

• T1572 · Protocol Tunneling

  Command And Control — During SharePoint ToolShell Exploitation, threat actors utilized ngrok tunnels to deliver PowerShell payloads.(Citation: Microsoft SharePoint Exploit JUL 2025)

• T1585.002 · Email Accounts

  Resource Development — During SharePoint ToolShell Exploitation, threat actors created Proton mail accounts for communication with organizations infected with ransomware.(Citation: Palo Alto SharePoint Vulnerabilities JUL 2025)

• T1082 · System Information Discovery

  Discovery — During SharePoint ToolShell Exploitation, threat actors fingerprinted targeted SharePoint servers to identify OS version and running processes.(Citation: Microsoft SharePoint Exploit JUL 2025)

• T1486 · Data Encrypted for Impact

  Impact — During SharePoint ToolShell Exploitation, threat actors deployed ransomware including 4L4MD4R and Warlock.(Citation: Microsoft SharePoint Exploit JUL 2025)(Citation: Palo Alto SharePoint Vulnerabilities JUL 2025)

• T1074.001 · Local Data Staging

  Collection — During SharePoint ToolShell Exploitation, threat actors staged stolen data from web.config files to debug_dev.js.(Citation: Palo Alto SharePoint Vulnerabilities JUL 2025)(Citation: Trend Micro SharePoint Attacks JUL 2025)

• T1505.004 · IIS Components

  Persistence — During SharePoint ToolShell Exploitation, threat actors modified Internet Information Services (IIS) components to load suspicious .NET assemblies for persistence.(Citation: Microsoft SharePoint Exploit JUL 2025)

• T1059.003 · Windows Command Shell

  Execution — During SharePoint ToolShell Exploitation, threat actors utilized `cmd.exe` and batch scripts within the victim environment.(Citation: Microsoft SharePoint Exploit JUL 2025)(Citation: ESET ToolShell JUL 2025)(Citation: Eye Research ToolShell JUL 2025)(Citation: SentinelOne ToolShell JUL 2025)

• T1027.010 · Command Obfuscation

  Stealth — During SharePoint ToolShell Exploitation, threat actors executed Base64-encoded PowerShell commands.(Citation: Microsoft SharePoint Exploit JUL 2025)(Citation: Eye Research ToolShell JUL 2025)(Citation: Trend Micro SharePoint Attacks JUL 2025)(Citation: SentinelOne ToolShell JUL 2025)(Citation: Palo Alto SharePoint Vulnerabilities JUL 2025)

• T1090 · Proxy

  Command And Control — During SharePoint ToolShell Exploitation, threat actors used Fast Reverse Proxy to communicate with C2.(Citation: Microsoft SharePoint Exploit JUL 2025)(Citation: ESET ToolShell JUL 2025)

• T1685 · Disable or Modify Tools

  Defense Impairment — During SharePoint ToolShell Exploitation, threat actors disabled Microsoft Defender through Registry settings and real-time monitoring via PowerShell.(Citation: Microsoft SharePoint Exploit JUL 2025)(Citation: Palo Alto SharePoint Vulnerabilities JUL 2025)

• T1588.002 · Tool

  Resource Development — During SharePoint ToolShell Exploitation, threat actors leveraged tools including Impacket, PsExec, and Mimikatz.(Citation: Microsoft SharePoint Exploit JUL 2025)

• T1569.002 · Service Execution

  Execution — During SharePoint ToolShell Exploitation, threat actors leveraged PsExec for command execution and used `services.exe` to disable Microsoft Defender via Registry keys.(Citation: Microsoft SharePoint Exploit JUL 2025)

• T1112 · Modify Registry

  Defense Impairment, Persistence — During SharePoint ToolShell Exploitation, threat actors, including Storm-2603, disabled security services via Registry modifications.(Citation: Microsoft SharePoint Exploit JUL 2025)

• T1620 · Reflective Code Loading

  Stealth — During SharePoint ToolShell Exploitation, threat actors reflectively loaded payloads using `System.Reflection.Assembly.Load`.(Citation: Microsoft SharePoint Exploit JUL 2025)(Citation: Eye Research ToolShell JUL 2025)(Citation: Trend Micro SharePoint Attacks JUL 2025)(Citation: SentinelOne ToolShell JUL 2025)(Citation: Palo Alto SharePoint Vulnerabilities JUL 2025)

• T1595.002 · Vulnerability Scanning

  Reconnaissance — During SharePoint ToolShell Exploitation, threat actors scanned for SharePoint servers vulnerable to CVE-2025-53770.(Citation: Palo Alto SharePoint Vulnerabilities JUL 2025)

• T1105 · Ingress Tool Transfer

  Command And Control — During SharePoint ToolShell Exploitation, threat actors used a loader to download and execute ransomware.(Citation: Palo Alto SharePoint Vulnerabilities JUL 2025)

• T1570 · Lateral Tool Transfer

  Lateral Movement — During SharePoint ToolShell Exploitation, threat actors used Impacket to remotely stage and execute payloads via WMI.(Citation: Microsoft SharePoint Exploit JUL 2025)

• T1041 · Exfiltration Over C2 Channel

  Exfiltration — During SharePoint ToolShell Exploitation, threat actors exfiltrated stolen credentials and internal data over HTTPS to C2 infrastructure.(Citation: Microsoft SharePoint Exploit JUL 2025)

• T1005 · Data from Local System

  Collection — During SharePoint ToolShell Exploitation, threat actors extracted information from the compromised systems.(Citation: Microsoft SharePoint Exploit JUL 2025)(Citation: ESET ToolShell JUL 2025)(Citation: SentinelOne ToolShell JUL 2025)(Citation: Palo Alto SharePoint Vulnerabilities JUL 2025)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0058

  Official MITRE ATT&CK campaign record C0058. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.