Active Exploitation of Microsoft Share Point Vulnerabilities: Threat Brief (Updated August 12)
Summary: Unit 42 documented active exploitation of the ToolShell SharePoint vulnerabilities (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771) from July 17, 2025, 08:40 UTC through July 22, 2025, by activity tracked as CL-CRI-1040, which tested targets starting July 17 at 06:58 UTC from Safing Privacy Network exit nodes. A failed July 27 exploitation attempt involving an encoded PowerShell command led to discovery of a loader for 4L4MD4R ransomware, a GoLang variant of open-source Mauri870 demanding 0.005 BTC.
What you should know: Unit 42 states that if you have internet-exposed on-premises SharePoint, you should assume compromise, and that patching alone is insufficient to evict the threat - while the actors exfiltrated cryptographic MachineKeys that grant future access and shifted payloads within days to evade detection.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-49704CVE-2025-49706CVE-2025-53770CVE-2025-53771
- Related
- Microsoft Fix Targets Attacks on Share Point Zero-Day Cyber Risks ·