Microsoft Traces On-Premises SharePoint Exploits to China

Hackers targeting zero-day vulnerabilities in Microsoft SharePoint appear to have focused on stealing cryptographic data to facilitate long-term, post-patch access to servers, security experts warn.

See Also: Securing Your Workforce with Datto RMM: Automating Patching, Hardening, and Backups

Microsoft, which has tied early exploitation activity to China, is rushing out emergency patches to help organizations blunt the exploit chain, dubbed ToolShell, being used. On-premises versions of SharePoint are at risk but SharePoint Online in Microsoft 365 is not (see: Attackers Exploit Zero-Day Flaws in On-Premises SharePoint).

As of Tuesday, patches for all supported versions of SharePoint server – Subscription Edition, 2019 and 2016 – are now available. Microsoft cautioned that further steps are necessary, including rotating keys, to eject attackers from already hacked systems.

The new patches address vulnerabilities tracked as CVE-2025-53770, a remote code execution vulnerability related to CVE-2025-49704, and CVE-2025-53771, which is a bypass for the fix for server spoofing vulnerability CVE-2025-49706.

As part of its regularly scheduled, monthly release of patches on July 8, Microsoft issued updates designed to fix CVE-2025-49704 and CVE-2025-49706. The new, emergency patches, issued in recent days, now include “more robust protections” for the underlying vulnerabilities, Microsoft said.

“As early as July 7, Microsoft analysis suggests threat actors were attempting to exploit CVE-2025-49706 and CVE-2025-49704 to gain initial access to target organizations,” the company’s Security Response Center said on Tuesday. Based on how the tactics, techniques and procedures used by attackers align with previous attacks, it said “these actors include Chinese state actors Linen Typhoon and Violet Typhoon and another China-based actor Storm-2603.”

Microsoft uses “Typhoon” designations in its threat actor nomenclature to refer to Chinese hacking groups. Linen Typhoon, also tracked as APT27 and Emissary Panda, has been in operation since 2012 and focuses on stealing intellectual property. Violet Typhoon, aka APT31 and Judgment Panda, is a cyberespionage group in operation since 2015. Storm-2603 appears to be a Chinese-based threat group, although its history and objectives remain unclear, Microsoft said.

After Microsoft patched CVE-2025-49704 and CVE-2025-49706 on July 8, the ToolShell attacks that chained together CVE-2025-53770 and CVE-2025-53771 appeared to begin nine days later.

Netherlands-based firm Eye Security said it tracked an apparent test wave of attacks targeting ToolShell that began Thursday at 12:51 UTC, followed by attacks on Friday at 18:06 UTC and Saturday at 7:28 UTC. The firm also reported seeing further “multiple waves” of attacks after security researchers released proof-of-concept exploit code for ToolShell on Monday. Eye Security said it has identified “dozens of systems actively compromised” and has been attempting to directly notify affected organizations.

According to Rapid7, “This campaign is not opportunistic – it is deliberate, capable and designed for persistence even after patching.” Rapid7 said it has seen “active exploitation” of the vulnerabilities in some of its customers’ IT environments.

“We’re aware of victims in several sectors and global geographies,” said Charles Carmakal, CTO of Google Cloud’s Mandiant. “The activity primarily involved the theft of machine key material which could be used to access victim environments after the patch has been applied.”

“What makes these vulnerabilities especially concerning is SharePoint’s deep integration with Microsoft’s platform, including their services like Office, Teams, OneDrive and Outlook, which have significant information that’s valuable to attackers,” Palo Alto Networks said. “A compromise in this situation doesn’t stay contained, it opens the door to the entire network.”

Shadowserver, which scans the internet looking for malicious activity, said it sees approximately 9,300 internet-connected SharePoint IP addresses on a daily basis, noting that this isn’t a count of vulnerable systems but just the general population.

Of these on-premises SharePoint systems, 3,000 are in the United States, followed by about 700 in the Netherlands, 600 in Ireland, 540 in the United Kingdom, 500 in Canada and around 320 to 330 in Germany, Australia and Japan.

“It’s critical to understand that multiple actors are now actively exploiting this vulnerability,” Mandiant’s Carmakal said. “We fully anticipate that this trend will continue, as various other threat actors, driven by diverse motivations, will leverage this exploit as well.”

Four-Step Attack

Cybersecurity firm Wiz said the ToolShell attack chain proceeds like this:

• Initial access: Attacker exploits the CVE-2025-53771 spoofing vulnerability to run a “path traversal” attack that allows them to escape a restricted directory;
• Deliver payload: Attacker employs the deserialization of untrusted data vulnerability CVE-2025-53770 to execute code that delivers a payload in the form of a web shell that gives them “persistent remote access to the server”;
• Extract keys: Attackers use the web shell to steal cryptographic key material that “are critical for forging valid, signed ASP.NET ViewState payloads that SharePoint will trust”;
• Remote code execution: Using the stolen keys, the attacker sends signed payloads to SharePoint that facilitate remote code execution.

Mitigation Advice

Regardless of who all is perpetrating such attacks, the advice from Microsoft and other security experts remains clear: All users of on-premises SharePoint servers should immediately install emergency patches from Microsoft, rotate their SharePoint server ASP.NET machine keys and invalidate old ones, restart Internet Information Services servers via iisreset.exe, activate additional security controls on their SharePoint servers, and review their servers for signs of compromise.

Echoing official advice from Microsoft, the U.S. Cybersecurity and Infrastructure Security Agency recommends all organizations that use on-premises SharePoint servers to “configure Antimalware Scan Interface – AMSI – in SharePoint and deploy Microsoft Defender AV on all SharePoint servers.” The AMSI is a vendor agnostic antimalware tool designed to facilitate deeper scanning of applications and services.

“If AMSI cannot be enabled, disconnect affected products from service that are public-facing on the internet” until patches and other remediation steps have been applied, CISA said.

Activating AMSI without patching SharePoint servers will not block attacks, said Benjamin Harris, CEO at watchTowr, who on Tuesday said his team have discovered a way to exploit CVE-2025-53770 that bypasses AMSI.

“We’re concerned to hear that some organizations are choosing to ‘enable AMSI’ instead of patching. This is a very bad idea,” he said. “Now that exploitation has been linked to nation-state actors, it would be naive to think they could leverage a SharePoint zero-day but somehow not bypass AMSI. Organizations must patch.”