INCIDENT REPORT · CP-2025-012

SharePoint 'ToolShell' zero-day exploitation

L3 · ELEVATEDCONFIRMED

Mass exploitation of a zero-day chain in on-premises Microsoft SharePoint Server compromised hundreds of servers worldwide; CISA added CVE-2025-53770 to its Known Exploited Vulnerabilities catalog.

Incident ID: CP-2025-012
Disclosure date: 19 JUL 2025
Detection date: 18 JUL 2025
Affected countries: United States
Plotted location: Washington, D.C., United States (Representative affected organizations (U.S. federal agencies incl. DOE/NNSA); campaign was global)
Threat classification: Level 3 — ELEVATED
Classification rationale: Global zero-day campaign that reached government agencies, including a nuclear security agency.
Attack type: Vulnerability Exploitation
Nature: Malicious activity
Attack vector: Exploitation of on-premises SharePoint Server vulnerabilities CVE-2025-53770/CVE-2025-53771 (bypasses of CVE-2025-49704/49706) for unauthenticated remote code execution and theft of ASP.NET machine keys
Sectors: Government, Energy, Technology, Education
Critical infrastructure: Yes
Organizations affected: U.S. Department of Energy / NNSA, Hundreds of organizations running on-premises SharePoint
Operational consequences: Eye Security reported 400+ compromised servers across about 148 organizations; the U.S. Department of Energy confirmed NNSA was affected but said impact was minimal. Some exploitation was used to deploy ransomware.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Attributed by Microsoft to China-based actors Linen Typhoon, Violet Typhoon and Storm-2603

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

SharePoint 'ToolShell' zero-day exploitation

L3 · ELEVATEDCONFIRMED

Mass exploitation of a zero-day chain in on-premises Microsoft SharePoint Server compromised hundreds of servers worldwide; CISA added CVE-2025-53770 to its Known Exploited Vulnerabilities catalog.

Incident ID

CP-2025-012

Disclosure date

19 JUL 2025

Detection date

18 JUL 2025

Affected countries

United States

Plotted location

Washington, D.C., United States (Representative affected organizations (U.S. federal agencies incl. DOE/NNSA); campaign was global)

Threat classification

Level 3 — ELEVATED

Classification rationale

Global zero-day campaign that reached government agencies, including a nuclear security agency.

Attack type

Vulnerability Exploitation

Nature

Malicious activity

Attack vector

Exploitation of on-premises SharePoint Server vulnerabilities CVE-2025-53770/CVE-2025-53771 (bypasses of CVE-2025-49704/49706) for unauthenticated remote code execution and theft of ASP.NET machine keys

Sectors

Government, Energy, Technology, Education

Critical infrastructure

Yes

Organizations affected

U.S. Department of Energy / NNSA, Hundreds of organizations running on-premises SharePoint

Operational consequences

Eye Security reported 400+ compromised servers across about 148 organizations; the U.S. Department of Energy confirmed NNSA was affected but said impact was minimal. Some exploitation was used to deploy ransomware.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Attributed by Microsoft to China-based actors Linen Typhoon, Violet Typhoon and Storm-2603