Post-Patch ToolShell Exploit Targeting Microsoft SharePoint

Chinese government-linked threat actors, including Linen Typhoon, Violet Typhoon, and Storm-2603, are actively exploiting a critical unauthenticated remote code execution (RCE) vulnerability in on-premises Microsoft SharePoint servers. Designated CVE-2025-53770 (dubbed "ToolShell"), this vulnerability allows attackers to bypass authentication and gain deep access to enterprise environments without user interaction. The campaign began as a zero-day exploit in early July 2025, and despite emergency patches, attackers have successfully deployed post-patch bypasses.

The attack chain involves targeting legacy ASP.NET logic in the ToolPane.aspx endpoint. Once exploited, attackers harvest cryptographic machine keys to forge tokens and maintain persistent access. This activity has been observed globally, targeting sensitive sectors such as government facilities, healthcare, and finance. Notable victims include the U.S. National Nuclear Security Administration, with over 60,000 attack attempts recorded in a single day.

This threat is particularly critical as SharePoint Server 2016 remains unpatched and vulnerable. The exploitation of legacy components and the ability to forge ViewState payloads demonstrate a sophisticated understanding of SharePoint's underlying architecture, necessitating immediate remediation and cryptographic hygiene.