US Nuclear Agency Breach Tied to SharePoint Zero Days

Hackers used zero-day flaws in Microsoft SharePoint to breach a U.S. government agency that maintains and designs the country’s nuclear weapons.

See Also: Securing Your Workforce with Datto RMM: Automating Patching, Hardening, and Backups

Hundreds of organizations have succumbed to vulnerabilities in the widely used Microsoft software collectively known as ToolShell (see: Microsoft Traces On-Premises SharePoint Exploits to China).

Hackers penetrated the National Nuclear Security Administration, a semi-autonomous part of the Department of Energy, as well as other parts of the same department, Bloomberg first reported Wednesday, citing a single, anonymous source.

The DOE didn’t immediately respond to a request for comment. But a spokesman told Bloomberg that hackers deployed ToolShell to leap past cyber defenses on Friday. “The department was minimally impacted due to its widespread use of the Microsoft M365 cloud and very capable cybersecurity systems,” the spokesman said. “A very small number of systems were impacted. All impacted systems are being restored.”

ToolShell chains together two Microsoft SharePoint vulnerabilities – CVE-2025-53770 and CVE-2025-53771, flaws for which Microsoft rushed out emergency patches.

Researchers at Netherlands-based cybersecurity firm Eye Security, among the first to spot the ToolShell campaign, said initial scans showed that hackers penetrated dozens of organizations. The company said it spotted the intrusion thanks to an alert from CrowdStrike Falcon EDR software it deployed at a customer environment, and that “the alert flagged a suspicious process chain on a legacy SharePoint on-prem server, tied to a recently uploaded malicious .aspx file.”

The firm revised upwards its count of victims, reporting Wednesday that more than 400 systems – out of over 23,000 it’s scanned so far – appear to have been exploited. The attacks have occurred across four waves, it said, beginning with an initial, likely test run on Thursday, followed by full-fledged attacks on Friday and Saturday and additional waves from Monday onwards, which was the same day multiple researchers publicly released proof-of-concept exploit code for ToolShell.

Citing an individual with knowledge of incident response investigations tied to the intrusions, Bloomberg said victims of the attack include multiple European and Middle Eastern governments, as well as the U.S. Department of Education, Florida’s Department of Revenue and the Rhode Island General Assembly.

In addition to releasing patches for all supported versions of SharePoint server – Subscription Edition, 2019 and 2016 – Microsoft published detailed additional, mandatory mitigation steps software administrators must take to protect their installations. Cloud versions of SharePoint are not at risk.

In a Monday blog post, Microsoft said efforts to exploit ToolShell began “as early as July 7,” one day before it issued patches for two separate flaws – CVE-2025-49704 and CVE-2025-49706 – that attackers were using to gain initial access to on-premises SharePoint installations.

The zero-day vulnerabilities attackers began exploiting Thursday – the ToolShell flaws CVE-2025-53770 and CVE-2025-53771 – appear to be variants of the vulnerabilities Microsoft tried to fix through the two July 8 patches. The vulnerabilities appear to have first come to light in the Pwn2Own Berlin competition, held at the OffensiveCon conference in mid-May, although no public details about the flaws themselves were released.

Microsoft said early attempts to exploit the flaws in the wild appeared to trace to three separate China-linked groups, which it tracks as Linen Typhoon, Violet Typhoon and Storm-2603.

The tech giant uses “Typhoon” designations in its threat actor nomenclature to refer to Chinese hacking groups. Linen Typhoon, also tracked as APT27 and Emissary Panda, has been in operation since 2012 and focuses on stealing intellectual property. Violet Typhoon, aka APT31 and Judgment Panda, is a cyberespionage group in operation since 2015. Storm-2603 appears to be a China-based threat group, although its history and objectives remain unclear, Microsoft said.

With proof-of-concept exploit code now readily available, security experts warned that multiple nation-state hacking teams and cybercrime groups have likely joined the fray.