Pierluigi Paganini July 22, 2025

While SentinelOne did not attribute the attack to a specific threat actor, The Washington Post linked it to China-nexus acors.

On July 19, Microsoft confirmed active exploitation of a zero-day vulnerability, tracked as CVE-2025-53770 in on-prem SharePoint Servers. The IT giant issued emergency patches for SharePoint Subscription Edition and 2019, with 2016 updates pending. Microsoft urges customers to immediately patch the vulnerability.

SentinelOne observed attacks on July 17 and identified three attack clusters with different tactics, while the attribution remains ongoing.

CVE-2025-53770 (ToolShell) exploit was initially used in targeted attacks against high-value organizations in sectors like tech consulting, manufacturing, critical infrastructure, and professional services tied to sensitive engineering and architecture. After public disclosure, the activity shifted to more opportunistic exploitation, with both nation-state actors and financially motivated actors attempting to exploit unpatched systems. Some actors are even setting up honeypots to test exploits and sharing tools and techniques across known underground platforms.

The ToolShell attack chain combines two previously patched SharePoint flaws (CVE-2025-49704 and CVE-2025-49706) that were demonstrated at Pwn2Own Berlin. It allows unauthenticated remote code execution by exploiting a logic flaw in SharePoint’s ToolPane page. Attackers use a crafted POST request to bypass authentication and run code via uploaded web components.

On July 18, 2025, SentinelOne researchers observed an attacker dropping a custom, password-protected ASPX webshell (xxx.aspx) to the SharePoint LAYOUTS directory. The shell enabled authentication, command execution, and file upload via basic HTML interfaces and used SHA512 hashing for access control. The actor tested it by executing a whoami command and saving output to a .js file.

Additionally, a second webshell (spinstall0.aspx) was observed in two attack waves on July 18–19. Both deployed the same payload, designed to extract sensitive cryptographic data. The attacks appeared manual, exploratory, and likely part of broader, ongoing preparations.

Between July 17 and 19, 2025, the researchers observed three distinct ToolShell exploitation waves, each with unique methods and goals:

First Wave (July 18):
From IP 107.191.58[.]76, attackers used PowerShell to deploy a base64-decoded payload (spinstall0.aspx) to the SharePoint LAYOUTS directory. This webshell wasn’t used for command execution but harvested MachineKey values—critical for forging authentication tokens and maintaining access in load-balanced environments.

Second Wave (July 19):
From IP 104.238.159[.]149, attackers repeated the same payload deployment, altering the directory path to target a different SharePoint version. Again, spinstall0.aspx extracted cryptographic secrets for persistence, not command execution.

“No Shell” Cluster (July 17–18):
From IP 96.9.125[.]147, this earliest and stealthiest wave used in-memory .NET module execution without writing files to disk. Attackers delivered encoded payloads and executed them dynamically via PowerShell or .NET reflection, making detection difficult. This fileless approach suggests a highly skilled red team or nation-state actor focused on stealth and credential harvesting.

All clusters targeted high-value SharePoint deployments, with a clear emphasis on persistence and access via cryptographic key theft, rather than immediate system control.

“Modern threat actors are maximizing gains from patch diffing, n-day adoption, and iterative development of  exploits through fast adoption. SharePoint servers are attractive to threat actors for the high likelihood that they store sensitive organizational data.” concludes SentinelOne. “Beyond their value as a knowledge store, vulnerable SharePoint servers can be used to stage and deliver additional attack components to the victim organization for internal watering hole attacks. The ease of exploitation and potential value of the data hosted on these servers make ‘ToolShell’ a potent and dangerous attack chain.”

While SentinelOne did not attribute the attack to a specific threat actor, The Washington Post, citing its source, reported that the attacks targeted SharePoint servers were likely conducted by unnamed China-linked threat actors.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, China)