LiveActive security incident?Get immediate response
MITRE ATT&CK® Campaign

C0058: SharePoint ToolShell Exploitation

The SharePoint ToolShell Exploitation campaign was conducted in July 2025 and encompassed the first waves of exploitation against incompletely patched spoofing (CVE-2025-49706) and remote code execution (CVE-2025-49704) vulnerabilities affecting on-premises Microsoft SharePoint servers. Later patched and updated as CVE-2025-53770 and CVE-2025-53771, the ToolShell vulnerabilities were widely exploited including by China-based ransomware actor Storm-2603 and espionage actors Threat Group-3390 and ZIRCONIUM. SharePoint ToolShell Exploitation targeted multiple regions and industries including finance, education, energy, and healthcare across Asia, Europe, and the United States.[1][2][3][4][5]

EnterpriseC0058CampaignObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

C0058: SharePoint ToolShell Exploitation describes The [SharePoint ToolShell Exploitation](https://attack.mitre.org/campaigns/C0058) campaign was conducted in July 2025 and encompassed the first waves of exploitation against incompletely patched spoofing (CVE-2025-49706) and remote code execution (CVE-2025-49704) vulnerabilities affecting on-premises Microsoft SharePoint servers. Later patched and updated as CVE-2025-53770 and CVE-2025-53771, the ToolShell vulnerabilities were widely exploited including by China-based ransomware actor Storm-2603 and espionage actor...

Executive priority

C0058: SharePoint ToolShell Exploitation is an official MITRE ATT&CK campaign. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate C0058: SharePoint ToolShell Exploitation by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata

Detection direction

  • Validate whether C0058: SharePoint ToolShell Exploitation appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

SharePoint ToolShell Exploitation

The SharePoint ToolShell Exploitation campaign was conducted in July 2025 and encompassed the first waves of exploitation against incompletely patched spoofing (CVE-2025-49706) and remote code execution (CVE-2025-49704) vulnerabilities affecting on-premises Microsoft SharePoint servers. Later patched and updated as CVE-2025-53770 and CVE-2025-53771, the ToolShell vulnerabilities were widely exploited including by China-based ransomware actor Storm-2603 and espionage actors Threat Group-3390 and ZIRCONIUM. SharePoint ToolShell Exploitation targeted multiple regions and industries including finance, education, energy, and healthcare across Asia, Europe, and the United States.[1][2][3][4][5]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

35 rows
DomainIDNameRelationship / procedure
EnterpriseT1053.005Scheduled TaskSub-technique

During SharePoint ToolShell Exploitation, threat actors used scheduled tasks to help establish persistence.[1]

EnterpriseT1033System Owner/User Discovery

During SharePoint ToolShell Exploitation, threat actors executed `whoami` on victim machines to enumerate user context and validate privilege levels.[1]CitationSentinelOne ToolShell JUL 2025

EnterpriseT1552.001Credentials In FilesSub-technique

During SharePoint ToolShell Exploitation, threat actors accessed web.config and machine.config to extract MachineKey values, enabling them to forge legitimate VIEWSTATE tokens for future deserialization payloads.[1][3][5]CitationSentinelOne ToolShell JUL 2025[2]

EnterpriseT1027.002Software PackingSub-technique

During SharePoint ToolShell Exploitation, threat actors UPX-packed malicous payloads including 4L4MD4R ransomware.[2]

EnterpriseT1071.001Web ProtocolsSub-technique

During SharePoint ToolShell Exploitation, threat actors issued HTTP `POST` requests to web shells with spoofed or empty Referrer headers, to circumvent authorization controls.[1][3][5]CitationSentinelOne ToolShell JUL 2025[2]

EnterpriseT1083File and Directory Discovery

During SharePoint ToolShell Exploitation, threat actors leveraged commands to locate accessible file shares, backup paths, or SharePoint content.[1]

EnterpriseT1505.003Web ShellSub-technique

During SharePoint ToolShell Exploitation, threat actors followed exploitation of SharePoint servers with installation of a malicious .aspx web shell (spinstall0.aspx) that was written to the `_layouts/15/` directory, granting persistent HTTP-based access.[1][4][3][5]CitationSentinelOne ToolShell JUL 2025[2]

EnterpriseT1583.001DomainsSub-technique

During SharePoint ToolShell Exploitation, threat actors registered C2 domains to spoof legitimate Microsoft domains.[1][2]

EnterpriseT1140Deobfuscate/Decode Files or Information

During SharePoint ToolShell Exploitation, threat actors decrypted scripts prior to execution.[2]

EnterpriseT1484.001Group Policy ModificationSub-technique

During SharePoint ToolShell Exploitation, threat actors, including Storm-2603, modified group policy to enable ransomware distribution.[1]

EnterpriseT1003.001LSASS MemorySub-technique

During SharePoint ToolShell Exploitation, threat actors used Mimikatz to dump LSASS memory.[1]

EnterpriseT1059.001PowerShellSub-technique

During SharePoint ToolShell Exploitation, threat actors used PowerShell to execute attacker-controlled encoded commands.[1][3]CitationSentinelOne ToolShell JUL 2025[2]

EnterpriseT1657Financial Theft

During SharePoint ToolShell Exploitation, threat actors demanded ransom payments to unencrypt filesystems and to refrain from publishing sensitive data exfiltrated from victim networks.[2]

EnterpriseT1190Exploit Public-Facing Application

During SharePoint ToolShell Exploitation, threat actors exploited authentication bypass and remote code execution vulnerabilities (CVE-2025-49706 and CVE-2025-49704) against on-premises SharePoint servers. This activity was characterized by crafted `POST` requests to the ToolPane endpoint `/_layouts/15/ToolPane.aspx`.[1][4][3][5]CitationSentinelOne ToolShell JUL 2025[2]

EnterpriseT1047Windows Management Instrumentation

During SharePoint ToolShell Exploitation, threat actors used WMI for execution.[1]

EnterpriseT1119Automated Collection

During SharePoint ToolShell Exploitation, threat actors used a command shell to automatically iterate through web.config files to expose and collect machineKey settings.[5][2]

EnterpriseT1572Protocol Tunneling

During SharePoint ToolShell Exploitation, threat actors utilized ngrok tunnels to deliver PowerShell payloads.[1]

EnterpriseT1585.002Email AccountsSub-technique

During SharePoint ToolShell Exploitation, threat actors created Proton mail accounts for communication with organizations infected with ransomware.[2]

EnterpriseT1082System Information Discovery

During SharePoint ToolShell Exploitation, threat actors fingerprinted targeted SharePoint servers to identify OS version and running processes.[1]

EnterpriseT1486Data Encrypted for Impact

During SharePoint ToolShell Exploitation, threat actors deployed ransomware including 4L4MD4R and Warlock.[1][2]

EnterpriseT1074.001Local Data StagingSub-technique

During SharePoint ToolShell Exploitation, threat actors staged stolen data from web.config files to debug_dev.js.[2][5]

EnterpriseT1505.004IIS ComponentsSub-technique

During SharePoint ToolShell Exploitation, threat actors modified Internet Information Services (IIS) components to load suspicious .NET assemblies for persistence.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

During SharePoint ToolShell Exploitation, threat actors utilized `cmd.exe` and batch scripts within the victim environment.[1][4][3]CitationSentinelOne ToolShell JUL 2025

EnterpriseT1027.010Command ObfuscationSub-technique

During SharePoint ToolShell Exploitation, threat actors executed Base64-encoded PowerShell commands.[1][3][5]CitationSentinelOne ToolShell JUL 2025[2]

EnterpriseT1090Proxy

During SharePoint ToolShell Exploitation, threat actors used Fast Reverse Proxy to communicate with C2.[1][4]

EnterpriseT1685Disable or Modify Tools

During SharePoint ToolShell Exploitation, threat actors disabled Microsoft Defender through Registry settings and real-time monitoring via PowerShell.[1][2]

EnterpriseT1588.002ToolSub-technique

During SharePoint ToolShell Exploitation, threat actors leveraged tools including Impacket, PsExec, and Mimikatz.[1]

EnterpriseT1569.002Service ExecutionSub-technique

During SharePoint ToolShell Exploitation, threat actors leveraged PsExec for command execution and used `services.exe` to disable Microsoft Defender via Registry keys.[1]

EnterpriseT1112Modify Registry

During SharePoint ToolShell Exploitation, threat actors, including Storm-2603, disabled security services via Registry modifications.[1]

EnterpriseT1620Reflective Code Loading

During SharePoint ToolShell Exploitation, threat actors reflectively loaded payloads using `System.Reflection.Assembly.Load`.[1][3][5]CitationSentinelOne ToolShell JUL 2025[2]

EnterpriseT1595.002Vulnerability ScanningSub-technique

During SharePoint ToolShell Exploitation, threat actors scanned for SharePoint servers vulnerable to CVE-2025-53770.[2]

EnterpriseT1105Ingress Tool Transfer

During SharePoint ToolShell Exploitation, threat actors used a loader to download and execute ransomware.[2]

EnterpriseT1570Lateral Tool Transfer

During SharePoint ToolShell Exploitation, threat actors used Impacket to remotely stage and execute payloads via WMI.[1]

EnterpriseT1041Exfiltration Over C2 Channel

During SharePoint ToolShell Exploitation, threat actors exfiltrated stolen credentials and internal data over HTTPS to C2 infrastructure.[1]

EnterpriseT1005Data from Local System

During SharePoint ToolShell Exploitation, threat actors extracted information from the compromised systems.[1][4]CitationSentinelOne ToolShell JUL 2025[2]

Associated objects

Groups, software, and campaigns

ToolEnterprise

S0029: PsExec

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers.[1][2]

Windows
ToolEnterprise

S0002: Mimikatz

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. [1] [2]

Windows
ToolEnterprise

S0508: ngrok

ngrok is a legitimate reverse proxy tool that can create a secure tunnel to servers located behind firewalls or on local machines that do not have a public IP. ngrok has been leveraged by threat actors in several campaigns including use for lateral movement and data exfiltration.[1][2][3][4]

Windows
ToolEnterprise

S0357: Impacket

Impacket is an open source collection of modules written in Python for programmatically constructing and manipulating network protocols. Impacket contains several tools for remote service execution, Kerberos manipulation, Windows credential dumping, packet sniffing, and relay attacks.[1]

LinuxmacOSWindows
Relationship explorer

All related ATT&CK context

uses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · ToolS0029: PsExecEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1552.001: Credentials In FilesEnterpriseuses · TechniqueT1027.002: Software PackingEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1505.003: Web ShellEnterpriseuses · TechniqueT1583.001: DomainsEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1484.001: Group Policy ModificationEnterpriseuses · TechniqueT1003.001: LSASS MemoryEnterpriseuses · ToolS0002: MimikatzEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1657: Financial TheftEnterpriseuses · TechniqueT1190: Exploit Public-Facing ApplicationEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1119: Automated CollectionEnterpriseuses · ToolS0508: ngrokEnterpriseuses · TechniqueT1572: Protocol TunnelingEnterpriseuses · TechniqueT1585.002: Email AccountsEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1486: Data Encrypted for ImpactEnterpriseuses · TechniqueT1074.001: Local Data StagingEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.2
Object version
1.0
Created
Modified
Raw hash
db7a6069d86d6bea...
Imported snapshots across ATT&CK releases(2)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.21.0Current bundledb7a6069d86d…
19.11.0Older bundle4725934193e7…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Microsoft SharePoint Exploit JUL 2025

    Microsoft Threat Intelligence. (2025, July 22). Disrupting active exploitation of on-premises SharePoint vulnerabilities. Retrieved October 15, 2025.

    Open source URL
  2. [2]
    Palo Alto SharePoint Vulnerabilities JUL 2025

    Unit 42. (2025, July 31). Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated). Retrieved October 15, 2025.

    Open source URL
  3. [3]
    Eye Research ToolShell JUL 2025

    Eye Security. (2025, July 19). SharePoint Under Siege: ToolShell Exploit (CVE-2025-49706 & CVE-2025-49704). Retrieved October 15, 2025.

    Open source URL
  4. [4]
    ESET ToolShell JUL 2025

    ESET Research. (2025, July 24). ToolShell: An all-you-can-eat buffet for threat actors. Retrieved October 15, 2025.

    Open source URL
  5. [5]
    Trend Micro SharePoint Attacks JUL 2025

    Trend Micro Research. (2022, July 22). Proactive Security Insights for SharePoint Attacks (CVE-2025-53770 and CVE-2025-53771). Retrieved October 15, 2025.

    Open source URL
  6. [6]
    mitre-attackC0058
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use