$base64String = "[.]" $destinationFile = "C:PROGRA~1COMMON~1MICROS~1WEBSER~116TEMPLATELAYOUTSspinstall0.aspx" $decodedBytes = [System.Convert]::FromBase64String($base64String) $decodedContent = [System.Text.Encoding]::UTF8.GetString($decodedBytes) $decodedContent | Set-Content -Path $destinationFile -ErrorAction Stop

  • Tip: Enable Enhanced PowerShell Logging to capture detailed script execution context.

4. Network Traffic Analysis

Monitor for connections to known malicious IPs associated with the ToolShell campaign:
  • IPs: 107.191.58.76, 104.238.159.149, 96.9.125.147
  • Tip: Use next-generation firewalls to block known C2 IPs and detect anomalous outbound traffic.

5. SIEM Hunting Queries

Leverage advanced hunting queries to detect compromise indicators:
  • Web Shell Detection: where FileName has “spinstall0” or FileName endswith “.aspx” and where the FolderPath is TEMPLATELAYOUTS
  • Suspicious Process Activity: where the initiating process is “w3wp.exe” and where process command line contains “spinstall0” or contains base64

6. Advanced Indicators (Fileless Attacks)

For fileless attacks observed in the “no shell” cluster, monitor for:
  • In-memory.NET execution by looking for System.Reflection.Assembly.Load calls in PowerShell logs, indicating dynamic assembly loading, behavioral anomalies like unusual memory usage spikes or w3wp.exe processes with high CPU/network activity. Use Sysinternals Process Monitor or Defender for Endpoint or other EDR to detect in-memory execution patterns.

Recent Developments (July 2025)

Since the initial disclosure of CVE-2025-53770 and CVE-2025-53771 on July 19, 2025, the ToolShell campaign has evolved rapidly:
  • Widespread Exploitation: Eye Security reported over 400 compromised SharePoint servers by July 22, with Check Point Research noting 4,600 compromise attempts across 300+ organizations by July 24. Affected sectors include government, energy, education, finance, and telecommunications.
  • Ransomware Deployment: On July 25, SOCRadar confirmed instances of Warlock ransomware deployed via the ToolShell exploit, targeting organizations in the U.S. and Europe. This underscores the campaign’s shift toward destructive payloads.
  • Nation-State Involvement: Microsoft identified Chinese nation-state actors Linen Typhoon, Violet Typhoon, and Storm-2603 exploiting these vulnerabilities, with Storm-2603 linked to ransomware attacks.
  • Public PoC Exploits: By July 21, proof-of-concept (PoC) exploits for CVE-2025-53770 and CVE-2025-53771 were published on GitHub, accelerating exploitation by less sophisticated actors.
  • Patch Status: Microsoft released patches for SharePoint Server 2019 and Subscription Edition on July 19, followed by SharePoint 2016 on July 22 (builds 16.0.5513.1001 and 16.0.18526.20508). However, end-of-life versions (SharePoint 2010 and 2013) remain vulnerable with no patches available.

Case Studies: Lessons from Real-World Compromises

Below are updated case studies illustrating the impact of the ToolShell campaign and lessons learned from incident response efforts.

Case Study 1: U.S. Energy Sector Firm

  • Initial Entry: Attackers exploited CVE-2025-53770 on July 18, 2025, from IP 107.191.58.76, deploying spinstall0.aspx to the LAYOUTS directory.
  • Persistence: Stolen MachineKey enabled attackers to forge ViewState payloads, regaining access 48 hours after the July 19 patch was applied.
  • Damage: Lateral movement to a domain controller via stolen SharePoint service account credentials; exfiltration of 2 GB of sensitive data, including employee records and intellectual property.
  • Missed Opportunity: Microsoft Defender alerts for suspicious PowerShell execution were dismissed as “normal SharePoint activity” for three days.
  • Resolution: Full Active Directory rebuild, key rotation, and implementation of network segmentation. The organization migrated to SharePoint Online to reduce future exposure.
  • Lesson: Timely alert triage and key rotation are critical to prevent re-entry post-patching.

Case Study 2: European University

  • Initial Entry: Attack from IP 104.238.159.149 on July 19 exploited CVE-2025-53770, dropping a modified spinstall0.aspx with AMSI-disabling logic.
  • Persistence: A scheduled task (SPConfigSync) executed a base64-encoded PowerShell payload every 30 minutes, maintaining C2 communication.
  • Damage: Compromised student and faculty data, with attackers pivoting to a linked OneDrive instance to exfiltrate research documents.
  • Missed Opportunity: Defender logs flagged anomalous w3wp.exe activity six days prior, but lack of expertise led to delayed response.
  • Resolution: Full system rebuild, registry scrub, and temporary suspension of internet-facing SharePoint services. The university accelerated plans for cloud migration.
  • Lesson: Advanced logging and skilled analysts are essential to detect sophisticated attacks early.

Case Study 3: Asian Telecommunications Provider

  • Initial Entry: Exploitation on July 17 from IP 96.9.125.147, part of the “no shell” cluster, using in-memory.NET execution to avoid disk-based artifacts.
  • Persistence: Attackers modified registry keys (HKLMSoftwareMicrosoftWindowsCurrentVersionRun) to execute a reflective DLL at startup.
  • Damage: Deployment of Warlock ransomware, encrypting critical billing and customer management systems.
  • Missed Opportunity: Lack of network egress controls allowed C2 communication to go undetected for 48 hours.
  • Resolution: Engaged Unit 42’s incident response team, restored systems from backups, and implemented Palo Alto Networks’ Cortex XDR for enhanced monitoring.
  • Lesson: Fileless attacks require behavioral monitoring and strict network controls to detect and prevent.

Strategic Recommendations (Beyond Patching)

To mitigate the ongoing threat of CVE-2025-53770 and CVE-2025-53771, organizations must adopt a layered defense strategy. Below are detailed recommendations based on the latest guidance from Microsoft, CISA, and security researchers.
Rotate ASP.NET Machine Keys Immediately
    • Stolen ValidationKey and DecryptionKey allow attackers to forge ViewState payloads, bypassing patches and PowerShell can be used to rotate the keys. Assume compromise for any internet facing SharePoint servers unpatched before July 20, 2025 and then restart IIS.
Audit Scheduled Tasks and Registry Entries
    • Attackers use scheduled tasks and registry keys for persistence.
      • Check for suspicious tasks using schtasks /query /fo LIST /v.
      • Audit HKLMSoftwareMicrosoftWindowsCurrentVersionRun and HKCUSoftwareMicrosoftWindowsCurrentVersionRun for unauthorized entries.
    • Look for tasks or keys with names mimicking SharePoint processes such as SPUpdate, SPHealth.
Implement File Integrity Monitoring (FIM)
    • Detect unauthorized ASPX uploads to the LAYOUTS directory and monitor for any .aspx file creation or modification.
Monitor for ViewState Anomalies
    • Forged __VIEWSTATE payloads are a common re-entry mechanism so use WAF or IDS rules to detect unusually large __VIEWSTATE fields (>10 KB) or unexpected POST requests to /ToolPane.aspx.

Segregate SharePoint Servers

    • Prevent lateral movement to critical systems by placing SharePoint servers in a dedicated VLAN with strict ingress/egress controls. Use private access tools to limit internet exposure. Disable unnecessary integrations with Teams, OneDrive, or Outlook until the environment is secured.
Enable AMSI and Deploy Endpoint Protection
    • AMSI blocks malicious payload execution, and EDR solutions detect post-exploit activity. Enable AMSI in Full Mode on SharePoint servers (enabled by default since September 2023 for SharePoint 2016/2019) and deploy an EDR solution.

It’s Not Over

The CVE-2025-53770 and CVE-2025-53771 exploitation campaign, dubbed ToolShell, highlights the devastating impact of deserialization vulnerabilities combined with authentication bypass flaws. The campaign’s rapid evolution fueled by public PoC exploits and nation-state actors underscores the need for proactive defense strategies. Patching alone is insufficient. Organizations must assume compromise for any on-premises SharePoint servers and implement comprehensive remediation, including key rotation, advanced monitoring, and network segmentation.
The ToolShell campaign also serves as a wake-up call for organizations relying on legacy on-premises SharePoint deployments. Migrating to SharePoint Online, where these vulnerabilities do not apply, may be a long-term solution for some. For those unable to migrate, layered defenses and vigilant monitoring are non-negotiable. Sources:

Migrating to SharePoint Online, where these vulnerabilities do not apply, may be a long-term solution for some.

Key takeaways

  • admin_panel.aspx

Need help with Part 2: Dissecting the SharePoint Exploit. Persistence, Dete?

TeckPath helps Calgary, Toronto, and Canadian businesses manage, secure, and modernize IT, with 24/7 support and SOC 2 Type II practices.

Talk to our team Managed IT services