MITRE ATT&CKcampaign
C0058 SharePoint ToolShell Exploitation
- Domain
- enterprise
- Version
- 1.0
- Created
- 2025-10-15
Description
The SharePoint ToolShell Exploitation campaign was conducted in July 2025 and encompassed the first waves of exploitation against incompletely patched spoofing (CVE-2025-49706) and remote code execution (CVE-2025-49704) vulnerabilities affecting on-premises Microsoft SharePoint servers. Later patched and updated as CVE-2025-53770 and CVE-2025-53771, the ToolShell vulnerabilities were widely exploited including by China-based ransomware actor Storm-2603 and espionage actors Threat Group-3390 and ZIRCONIUM. SharePoint ToolShell Exploitation targeted multiple regions and industries including finance, education, energy, and healthcare across Asia, Europe, and the United States.
Related
Uses · MITRE ATT&CK (39)
- T1685 Disable or Modify Tools technique
- S0508 ngrok software (tool)
- T1657 Financial Theft technique
- T1027.010 Command Obfuscation sub-technique
- T1620 Reflective Code Loading technique
- T1505.004 IIS Components sub-technique
- T1484.001 Group Policy Modification sub-technique
- T1595.002 Vulnerability Scanning sub-technique
- T1585.002 Email Accounts sub-technique
- T1588.002 Tool sub-technique
- T1583.001 Domains sub-technique
- T1071.001 Web Protocols sub-technique
- T1572 Protocol Tunneling technique
- T1074.001 Local Data Staging sub-technique
- T1570 Lateral Tool Transfer technique
- T1569.002 Service Execution sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1003.001 LSASS Memory sub-technique
- T1027.002 Software Packing sub-technique
- T1552.001 Credentials In Files sub-technique
- T1505.003 Web Shell sub-technique
- T1053.005 Scheduled Task sub-technique
- T1486 Data Encrypted for Impact technique
- S0357 Impacket software (tool)
- T1190 Exploit Public-Facing Application technique
- T1140 Deobfuscate/Decode Files or Information technique
- S0002 Mimikatz software (tool)
- S0029 PsExec software (tool)
- T1005 Data from Local System technique
References
- https://www.trendmicro.com/en_us/research/25/g/cve-2025-53770-and-cve-2025-53771-sharepoint-attacks.html Trend Micro SharePoint Attacks JUL 2025
- https://www.welivesecurity.com/en/eset-research/toolshell-an-all-you-can-eat-buffet-for-threat-actors/ ESET ToolShell JUL 2025
- https://research.eye.security/sharepoint-under-siege/ Eye Research ToolShell JUL 2025
- https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/#storm-2603 Microsoft SharePoint Exploit JUL 2025
- https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/ Palo Alto SharePoint Vulnerabilities JUL 2025