IR Trends Q3 2025: Tool Shell attacks dominate, highlighting criticality of segmentation and rapid response
Summary: Cisco Talos Incident Response reports that threat actors used public-facing application exploitation for initial access in over 60 percent of engagements this quarter, up from less than 10 percent last quarter, largely driven by ToolShell attacks on on-premises Microsoft SharePoint servers via CVE-2025-53770 and CVE-2025-53771, with active exploitation first observed in the wild on July 18, a day before Microsoft's emergency advisory. Ransomware fell to roughly 20 percent of engagements from 50 percent last quarter, while post-exploitation phishing from compromised valid accounts appeared in a third of engagements, and public administration was the most targeted vertical for the first time since Talos IR began documenting engagements in 2021.
Bottom line: Almost all Talos IR engagements responding to ToolShell activity began within 10 days of the July 18 exploitation, and in one case attackers moved credential-stealing malware from a compromised SharePoint server to an internal SharePoint database server, then hit the victim with ransomware weeks later - the window between patch availability and compromise is now measured in days, and a single unsegmented server is enough to carry an intrusion into the internal network.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2025-49704CVE-2025-49706CVE-2025-53770CVE-2025-53771
- Related
- Microsoft Fix Targets Attacks on Share Point Zero-Day Cyber Risks ·