Chinese Threat Actors Exploit Tool Shell Share Point Flaw Weeks After Microsoft's July Patch
Summary: Chinese threat actors exploited CVE-2025-53770, a now-patched authentication bypass and remote code execution flaw in on-premise Microsoft SharePoint publicly disclosed and patched in July 2025, to breach a Middle East telecommunications company and government bodies in Africa, among other victims. Symantec attributed the activity to China-based actors including Salt Typhoon, which deployed Zingdoor, ShadowPad, and KrustyLoader, with some intrusions using CVE-2021-36942 (PetitPotam) for privilege escalation and domain compromise alongside living-off-the-land tools for scanning and credential theft.
Bottom line: The flaw was exploited after its July 2025 patch, and Symantec says the attackers' activity points to credential theft and persistent, stealthy access likely for espionage - meaning an unpatched or overlooked on-premise SharePoint server is the exposure that matters here.