CISA releases malware analysis for Sharepoint Server attack

CISA has published a malware analysis report with compromise indicators and Sigma rules for "ToolShell" attacks targeting specific Microsoft SharePoint Server versions. "Cyber threat actors have chained CVE-2025-49704 and CVE-2025-49706 (in an exploit chain publicly known as 'ToolShell') to gain unauthorised access to on-premises SharePoint servers," the agency explained in its announcement of the report. "CISA analysed six files including two Dynamic Link-Library (.DLL), one cryptographic key stealer, and three web shells. Cyber threat actors could leverage this malware to steal cryptographic keys and execute a Base64-encoded PowerShell command to fingerprint host system and exfiltrate data." The key vulnerability in SharePoint Server, the "critical"-rated CVE-2025-53770 with a CVSS score of 9.8, built upon the earlier "medium" severity CVE-2025-49706 - a flaw Microsoft thought it had patched last month, only to find it under active exploitation as a zero-day targeting some big names. Linked with other vulnerabilities in an exploit chain dubbed "Toolshell", the vulnerability allows for remote code execution through untrusted data deserialisation, and is known to have been exploited by groups including Linen Typhoon (aka Emissary Panda, APT27), Violet Typhoon (aka Zirconium, Judgment Panda, APT31), and Storm-2603. As of the July 23, the victim count had risen to more than 400 including the US Department of Energy (DOE), which confirmed to The Register that its National Nuclea...