DuringSharePoint ToolShell Exploitation, threat actors registered C2 domains to spoof legitimate Microsoft domains.^[1][2]

DuringSharePoint ToolShell Exploitation, threat actors scanned for SharePoint servers vulnerable to CVE-2025-53770.^[2]

DuringSharePoint ToolShell Exploitation, threat actors issued HTTPPOST requests to web shells with spoofed or empty Referrer headers, to circumvent authorization controls.^{[1][3][5][6][2]}

DuringSharePoint ToolShell Exploitation, threat actors used a command shell to automatically iterate through web.config files to expose and collect machineKey settings.^[5][2]

DuringSharePoint ToolShell Exploitation, threat actors used PowerShell to execute attacker-controlled encoded commands.^[1][3][6][2]

DuringSharePoint ToolShell Exploitation, threat actors utilizedcmd.exe and batch scripts within the victim environment.^[1][4][3][6]

DuringSharePoint ToolShell Exploitation, threat actors deployed ransomware including 4L4MD4R and Warlock.^[1][2]

DuringSharePoint ToolShell Exploitation, threat actors extracted information from the compromised systems.^[1][4][6][2]

DuringSharePoint ToolShell Exploitation, threat actors staged stolen data from web.config files to debug_dev.js.^[2][5]

DuringSharePoint ToolShell Exploitation, threat actors decrypted scripts prior to execution.^[2]

DuringSharePoint ToolShell Exploitation, threat actors, including Storm-2603, modified group policy to enable ransomware distribution.^[1]

DuringSharePoint ToolShell Exploitation, threat actors created Proton mail accounts for communication with organizations infected with ransomware.^[2]

DuringSharePoint ToolShell Exploitation, threat actors exfiltrated stolen credentials and internal data over HTTPS to C2 infrastructure.^[1]

DuringSharePoint ToolShell Exploitation, threat actors exploited authentication bypass and remote code execution vulnerabilities (CVE-2025-49706 and CVE-2025-49704) against on-premises SharePoint servers. This activity was characterized by craftedPOST requests to the ToolPane endpoint/_layouts/15/ToolPane.aspx.^{[1][4][3][5][6][2]}

DuringSharePoint ToolShell Exploitation, threat actors leveraged commands to locate accessible file shares, backup paths, or SharePoint content.^[1]

DuringSharePoint ToolShell Exploitation, threat actors demanded ransom payments to unencrypt filesystems and to refrain from publishing sensitive data exfiltrated from victim networks.^[2]

DuringSharePoint ToolShell Exploitation, threat actors disabled Microsoft Defender through Registry settings and real-time monitoring via PowerShell.^[1][2]

DuringSharePoint ToolShell Exploitation, threat actors used a loader to download and execute ransomware.^[2]

DuringSharePoint ToolShell Exploitation, threat actors usedImpacket to remotely stage and execute payloads via WMI.^[1]

DuringSharePoint ToolShell Exploitation, threat actors, including Storm-2603, disabled security services via Registry modifications.^[1]

DuringSharePoint ToolShell Exploitation, threat actors UPX-packed malicous payloads including 4L4MD4R ransomware.^[2]

DuringSharePoint ToolShell Exploitation, threat actors executed Base64-encoded PowerShell commands.^{[1][3][5][6][2]}

DuringSharePoint ToolShell Exploitation, threat actors leveraged tools includingImpacket,PsExec, andMimikatz.^[1]

DuringSharePoint ToolShell Exploitation, threat actors usedMimikatz to dump LSASS memory.^[1]

DuringSharePoint ToolShell Exploitation, threat actors utilizedngrok tunnels to deliver PowerShell payloads.^[1]

DuringSharePoint ToolShell Exploitation, threat actors used Fast Reverse Proxy to communicate with C2.^[1][4]

DuringSharePoint ToolShell Exploitation, threat actors reflectively loaded payloads usingSystem.Reflection.Assembly.Load.^{[1][3][5][6][2]}

DuringSharePoint ToolShell Exploitation, threat actors used scheduled tasks to help establish persistence.^[1]

DuringSharePoint ToolShell Exploitation, threat actors followed exploitation of SharePoint servers with installation of a malicious .aspx web shell (spinstall0.aspx) that was written to the_layouts/15/ directory, granting persistent HTTP-based access.^{[1][4][3][5][6][2]}

DuringSharePoint ToolShell Exploitation, threat actors modified Internet Information Services (IIS) components to load suspicious .NET assemblies for persistence.^[1]

DuringSharePoint ToolShell Exploitation, threat actors fingerprinted targeted SharePoint servers to identify OS version and running processes.^[1]

DuringSharePoint ToolShell Exploitation, threat actors executedwhoami on victim machines to enumerate user context and validate privilege levels.^[1][6]

DuringSharePoint ToolShell Exploitation, threat actors leveragedPsExec for command execution and usedservices.exe to disable Microsoft Defender via Registry keys.^[1]

DuringSharePoint ToolShell Exploitation, threat actors accessed web.config and machine.config to extract MachineKey values, enabling them to forge legitimate VIEWSTATE tokens for future deserialization payloads.^{[1][3][5][6][2]}

DuringSharePoint ToolShell Exploitation, threat actors used WMI for execution.^[1]

^[1]

^[1]

^[1]

^[1]