Threat Briefing: CVE-2025-53770 “ToolShell” – Active SharePoint Zero Day

O365 SharePoint online is unaffected, this only applies to SharePoint 2013+ on premise.

What’s Happening

Vulnerability: A critical (CVSS 9.8) deserialization flaw in on-premises Microsoft SharePoint Server allows unauthenticated remote code execution over the network.

Active Exploitation: Microsoft has confirmed that this vulnerability is being exploited in the wild.

Scope Impacted: Only on-premises SharePoint environments are vulnerable. SharePoint Online (Microsoft 365) is not affected.

See Microsoft’s customer guidance for Sharepoint vulnerability

Exploitation Breakdown

Attackers craft malicious serialized data that is improperly deserialized by the server, leading to unauthenticated remote code execution. No prior access or user interaction is required.

Severity and CVSS

This vulnerability has a CVSS v3.1 score of 9.8. It is network-based, low complexity, requires no privileges or user interaction, and results in full confidentiality, integrity, and availability impact.

Mitigation Recommendations (Until Patch is Released)

According to Microsoft:

• Deploy Defender for Endpoint to detect post-exploitation activity.

• Ensure AMSI integration in on-prem SharePoint Server.

• Enable Microsoft Defender Antivirus on all SharePoint hosts.

• If AMSI cannot be enabled, disconnect vulnerable systems from the internet.

In Case of a Successful Compromise

Threat Actors have been observed looking for machine keys:
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys

Rotate ASP.NET Machine Keys: Ifsensitive machine keys were exposed, immediately rotate or regenerate the machine keys in SharePoint’s web.config files to invalidate any potentially compromised keys. (given after successful exploitation). See Microsoft’s guidance about key rotation.

Detection and Hunting Guidance

Defender AV Detections

• Exploit:Script/SuspSignoutReq.A

• Trojan:Win32/HijackSharePointServer.A

Defender for Endpoint Alerts to Monitor

• Possible web shell installation

• Suspicious IIS worker process behavior

• ‘SuspSignoutReq’ malware was blocked

Advanced KQL Query for Hunting (we have already hunted using this)

DeviceFileEvents
| where FolderPath matches regex @"Web Server Extensions\\\d+\\TEMPLATE\\LAYOUTS"
| where (FileName =~ "spinstall0.aspx" or FileName has "spinstall0")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, ReportId, ActionType, SHA256
| order by Timestamp desc

DeviceFileEvents
| where FolderPath matches regex @"Web Server Extensions\\\d+\\TEMPLATE\\LAYOUTS"
| where (FileName =~ "spinstall0.aspx" or FileName has "spinstall0")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, ReportId, ActionType, SHA256
| order by Timestamp desc

DeviceFileEvents
| where FolderPath matches regex @"Web Server Extensions\\\d+\\TEMPLATE\\LAYOUTS"
| where (FileName =~ "spinstall0.aspx" or FileName has "spinstall0")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, ReportId, ActionType, SHA256
| order by Timestamp desc

DeviceFileEvents
| where FolderPath matches regex @"Web Server Extensions\\\d+\\TEMPLATE\\LAYOUTS"
| where (FileName =~ "spinstall0.aspx" or FileName has "spinstall0")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, ReportId, ActionType, SHA256
| order by Timestamp desc

Timeline and Outlook

Final Update July 21, 2025

For further minor updates, please refer to the Microsoft Customer Guidance.

July 21, 2025

Microsoft Published SharePoint 2016 Security Updates.

July 21, 2025

Microsoft Released Disruption Blog Post and attributed the attack to Linen Typhoon, Violet Typhoon and Storm-2603 based on the TTPs employed in these exploits:

• “Linen Typhoon has focused on stealing intellectual property, primarily targeting organizations related to government, defense, strategic planning, and human rights”

• “Violet Typhoon .. has been dedicated to espionage, primarily targeting former government and military personnel, non-governmental organizations (NGOs), think tanks, higher education, digital and print media, financial and health related sectors in the United States, Europe and East Asia”

• “Storm-2603 is assessed with medium confidence to be a China-based threat actor”

July 20, 2025

Microsoft Clarified affected SharePoint product in summary.

• Fix availability guidance made available.

• Additional protections guidance. Microsoft also added security updates for SharePoint products to supported versions.

• Recommendations, including installing July 2025 Security Updates, as well as Rotating machine keys.

• SharePoint 2019 security update, included links to CVEs and published security updates. (A patch for Sharepoint 2016 is still pending)

See Microsoft’s vulnerability documentation

See proof of concept exploit

July 19, 2025

• Microsoft published the advisory and confirmed active exploitation.

• No patch has been released yet, but one is currently being tested. An out-of-band update is expected soon.

• Threat intelligence suggests groups such as Silk Typhoon or Storm-0506 may be involved.

Immediate Action Plan (if you have Sharepoint on-Premise)

Indicators of Compromise

Review the indicators of compromise on GitHub

Summary

CVE-2025-53770 is a critical zero-day vulnerability currently being exploited in the wild. Organizations running on-prem SharePoint must implement mitigations immediately, monitor for signs of compromise, and prepare for a patch release.