English
English Indonesia Türkçe Deutsch Español Português Pусский Français Italiano Nederlands Polski العربية ไทย Tiếng Việt 繁體中文 简体中文 日本語 한국어

#toolshell search results

_l0gg's profile picture.
Khoa Dinh
 @_l0gg
Jul 24

Blog for ToolShell Disclaimer: The content of this blog is provided for educational and informational purposes only. blog.viettelcybersecurity.com/sharepoint-too… #SharePoint #ToolShell

_l0gg's tweet image. Blog for ToolShell Disclaimer: The content of this blog is provided for educational and informational purposes only. blog.viettelcybersecurity.com/sharepoint-too… #SharePoint #ToolShell
10
84
247
91
25K
0x534c's profile picture. #Cybersecurity #Sentinel #DefenderXDR #KQL #KQLWizard
Steven Lim
@0x534c
Jul 24

#ToolShell #Warlock 🚨 KQLWizard intel update: Storm-2603 exploited CVE-2025-53770 on 4 internet-facing SharePoint servers on 22 July, deploying Warlock ransomware via ToolShell. Initial access confirmed via observed hash for IIS_Server_dll.dll (Storm-2603 IIS Backdoor).…

0x534c's tweet image. #ToolShell #Warlock 🚨 KQLWizard intel update: Storm-2603 exploited CVE-2025-53770 on 4 internet-facing SharePoint servers on 22 July, deploying Warlock ransomware via ToolShell. Initial access confirmed via observed hash for IIS_Server_dll.dll (Storm-2603 IIS Backdoor).…
2
31
123
54
9K
arastuq's profile picture. so many technologies, so little time. visionary at heart, an engineer at scale, and a manager at the chaos.
Touhid Arastu
 @arastuq
Aug 9, 2017

I started learning #React Native today and I want to quite already :D #JavaScript #toolsHell #tehranjs

arastuq's tweet image. I started learning #React Native today and I want to quite already :D #JavaScript #toolsHell #tehranjs
5
3
36
0
0
_l0gg's profile picture.
Khoa Dinh
 @_l0gg
Jul 24

Viettel Cyber Security Press Release for Customer alert, Latest research and Recommendations. Blog is comming viettelsecurity.com/microsoft-shar… #SharePoint #ToolShell

_l0gg's tweet image. Viettel Cyber Security Press Release for Customer alert, Latest research and Recommendations. Blog is comming viettelsecurity.com/microsoft-shar… #SharePoint #ToolShell
0
4
26
5
3K
twelvesec's profile picture. Information security , knowledge sharing, community supporter.
twelvesec
 @twelvesec
Oct 23

China associated #hackers have leveraged the #ToolShell #vulnerability (CVE-2025-53770) in #Microsoft #SharePoint #cyberattacks targeting government agencies, universities, telecommunication service providers, and finance organisations. #CyberSecurity ift.tt/SM98RkY

twelvesec's tweet image. China associated #hackers have leveraged the #ToolShell #vulnerability (CVE-2025-53770) in #Microsoft #SharePoint #cyberattacks targeting government agencies, universities, telecommunication service providers, and finance organisations. #CyberSecurity ift.tt/SM98RkY
0
0
1
0
132
CISACyber's profile picture. Part of @CISAgov, we respond to major incidents, analyze threats, and exchange critical cybersecurity information with partners around the world.
CISA Cyber
 @CISACyber
Aug 6

We’ve released a Malware Analysis Report with analysis & detection signatures on files related to Microsoft SharePoint vulnerabilities known as #ToolShell. Review IOCs and detection signatures in our 🆕report 👉 cisa.gov/news-events/an…

1
105
253
98
30K
2toLead's profile picture. We are a generous #Microsoft consulting company. Leaders in the #DigitalWorkplace #EmployeeExperience #M365 #SharePoint #Intranet #MSFTViva #MicrosoftCopilot +
2toLead
 @2toLead
Sep 10

🚨 WARNING: Cloud migration isn’t optional! Researchers uncovered #ToolShell, a vulnerability chain giving attackers full control of on-prem #SharePoint. Start with an intranet audit & content inventory to keep your SharePoint secure. Learn more 🔗 2tl.co/4mnsO3D

2toLead's tweet image. 🚨 WARNING: Cloud migration isn’t optional! Researchers uncovered #ToolShell, a vulnerability chain giving attackers full control of on-prem #SharePoint. Start with an intranet audit & content inventory to keep your SharePoint secure. Learn more 🔗 2tl.co/4mnsO3D
0
0
1
0
70
0x534c's profile picture. #Cybersecurity #Sentinel #DefenderXDR #KQL #KQLWizard
Steven Lim
@0x534c
Jul 21

CISA Adds One Known Exploited Vulnerability, CVE-2025-53770 “ToolShell,” to Catalog cisa.gov/news-events/al… #Cybersecurity #Sharepoint #toolshell

0x534c's tweet image. CISA Adds One Known Exploited Vulnerability, CVE-2025-53770 “ToolShell,” to Catalog cisa.gov/news-events/al… #Cybersecurity #Sharepoint #toolshell
1
17
77
25
5K
Unit42_Intel's profile picture. The latest research and news from Unit 42, the Palo Alto Networks (@paloaltontwks) Threat Intelligence and Security Consulting Team covering incident response.
Unit 42
 @Unit42_Intel
Jul 31

Unit 42 recently identified an unattributed group leveraging the recent #ToolShell exploits to deliver 4L4MD4R #ransomware on July 27th 2025. More info at bit.ly/4l76eL4

Unit42_Intel's tweet image. Unit 42 recently identified an unattributed group leveraging the recent #ToolShell exploits to deliver 4L4MD4R #ransomware on July 27th 2025. More info at bit.ly/4l76eL4
2
18
72
24
12K
Gi7w0rm's profile picture. Threat Intelligence Analyst | See my Linktree for other socials | In case I post false intel, contact me! Support me: https://t.co/5WgDqr0K8p 🇪🇺🇩🇪🇺🇦🌈
Gi7w0rm
 @Gi7w0rm
Jul 23

Quck analysis of new #ToolShell payload observed by @leak_ix: Paylaod is a .dll executed in memory. Sha-256: 3461da3a2ddcced4a00f87dcd7650af48f97998a3ac9ca649d7ef3b7332bd997 It collects System Info and the sensitive machine key. Sends back in response. Single Request takeover.

Gi7w0rm's tweet image. Quck analysis of new #ToolShell payload observed by @leak_ix: Paylaod is a .dll executed in memory. Sha-256: 3461da3a2ddcced4a00f87dcd7650af48f97998a3ac9ca649d7ef3b7332bd997 It collects System Info and the sensitive machine key. Sends back in response. Single Request takeover.
Gi7w0rm's profile picture. Threat Intelligence Analyst | See my Linktree for other socials | In case I post false intel, contact me! Support me: https://t.co/5WgDqr0K8p 🇪🇺🇩🇪🇺🇦🌈
Gi7w0rm
 @Gi7w0rm
Jul 23

⚠️ New payload in the relation to #ToolShell . Attackers now don't need the static file anymore, leaking keys from memory without leaving the file. This means the existence of a file is not a reliable IoC anymore.

1
21
56
11
28K
4
48
153
50
25K
SoyITPro's profile picture. 📚 Te enseño sobre tecnologías Microsoft para las empresas ☁️ Azure 💻 Windows Server 👨🏻‍💻 Windows Cliente 🏅Microsoft MVP 💙 YouTube
SoyITPro.com
@SoyITPro
Jul 23

Departamento de armas nucleares de EEUU comprometido por ataque a #SharepointServer #ToolShell

0
2
19
5
925
EsetJapan's profile picture. ESETは、30年以上にわたりテクノロジーにおける“進化”を”保護”し続けてきました。Progress. Protected.は、私たちESETのストーリーです。 世界中のラボからの最新セキュリティ情報はhttps://t.co/LluwttbQef で公開しています。
ESETJapan（イーセットジャパン）
 @EsetJapan
Jul 31

SharePoint脆弱性を悪用する #ToolShell に注意！🇨🇳中国系攻撃グループによる悪用も報告されていますが、#ESET もLuckyMouseに関連するバックドアを検出。ESETの監視結果はブログで掲載→ htps://www.eset.com/jp/blog/welivesecurity/toolshell-an-all-you-can-eat-buffet-for-threat-actors-jp/

EsetJapan's tweet image. SharePoint脆弱性を悪用する #ToolShell に注意！🇨🇳中国系攻撃グループによる悪用も報告されていますが、#ESET もLuckyMouseに関連するバックドアを検出。ESETの監視結果はブログで掲載→ htps://www.eset.com/jp/blog/welivesecurity/toolshell-an-all-you-can-eat-buffet-for-threat-actors-jp/
1
1
3
0
507
craiu's profile picture. Cybersecurity researcher focused on threat intel & APTs. Breaking down attacks, hunting threats, and crafting YARA rules. Buddy @ Three Buddy Problem
Costin Raiu
@craiu
Jul 26

The "no shell" activity cluster was seen exploiting the SharePoint vuln on 17th - one day ahead of others - using no filesystem artifacts. Very cool finding by @TomHegel and friends at @LabsSentinel #toolshell #noshell Link to the blog below ->

craiu's tweet image. The "no shell" activity cluster was seen exploiting the SharePoint vuln on 17th - one day ahead of others - using no filesystem artifacts. Very cool finding by @TomHegel and friends at @LabsSentinel #toolshell #noshell Link to the blog below ->
1
11
46
24
4K
RedDrip7's profile picture. Technical Twitter of QiAnXin Technology, leading Chinese security vendor. It is operated by RedDrip Team which focuses on malware, APT and threat intelligence.
RedDrip Team
 @RedDrip7
Jul 30

"Mimo" Gang used #Sharepoint #ToolShell to deliver "4l4md4r" #ransomware, which is written in Go language and contains religious-style function names. Report: mp.weixin.qq.com/s/h6_ijQAHhq4t…

RedDrip7's tweet image. "Mimo" Gang used #Sharepoint #ToolShell to deliver "4l4md4r" #ransomware, which is written in Go language and contains religious-style function names. Report: mp.weixin.qq.com/s/h6_ijQAHhq4t…
RedDrip7's tweet image. "Mimo" Gang used #Sharepoint #ToolShell to deliver "4l4md4r" #ransomware, which is written in Go language and contains religious-style function names. Report: mp.weixin.qq.com/s/h6_ijQAHhq4t…
1
7
40
11
4K
CISACyber's profile picture. Part of @CISAgov, we respond to major incidents, analyze threats, and exchange critical cybersecurity information with partners around the world.
CISA Cyber
 @CISACyber
Jul 20

Malicious actors are exploiting RCE vulnerability CVE-2025-53770 to compromise on-prem SharePoint servers. See our Alert for info & mitigations on exploitation activity, known as #ToolShell. 👉go.dhs.gov/iZZ

CISACyber's tweet image. Malicious actors are exploiting RCE vulnerability CVE-2025-53770 to compromise on-prem SharePoint servers. See our Alert for info & mitigations on exploitation activity, known as #ToolShell. 👉go.dhs.gov/iZZ
4
65
155
27
39K
wiz_io's profile picture. Secure everything you build and run in the cloud
Wiz
@wiz_io
Jul 21

🚨 Research update: #ToolShell is back, and it just leveled up. Two new vulnerabilities in Microsoft SharePoint Server, CVE-2025-53770 (RCE) and CVE-2025-53771 (auth bypass), are being actively exploited in the wild. 🔓 Attackers are chaining them to >> • Bypass authentication…

wiz_io's tweet image. 🚨 Research update: #ToolShell is back, and it just leveled up. Two new vulnerabilities in Microsoft SharePoint Server, CVE-2025-53770 (RCE) and CVE-2025-53771 (auth bypass), are being actively exploited in the wild. 🔓 Attackers are chaining them to >> • Bypass authentication…
0
6
24
2
3K
blackorbird's profile picture. Peace and Love. Just Analysis/Hunter/Youtuber/AiCoder/Entrepreneur/. #APT #threatIntelligence #Exploit #CTI #meme #cyber #hacker #OSINT #Ai Need Remote Job
blackorbird
@blackorbird
Jul 25

Attacker IP addresses Update #toolshell welivesecurity.com/en/eset-resear…

blackorbird's tweet image. Attacker IP addresses Update #toolshell welivesecurity.com/en/eset-resear…
blackorbird's profile picture. Peace and Love. Just Analysis/Hunter/Youtuber/AiCoder/Entrepreneur/. #APT #threatIntelligence #Exploit #CTI #meme #cyber #hacker #OSINT #Ai Need Remote Job
blackorbird
@blackorbird
Jul 21

ToolShell Mass Exploitation (CVE-2025-53770) Stealing machine keys to maintain persistent access SharePoint -> The exchange server is the next target research.eye.security/sharepoint-und…

blackorbird's tweet image. ToolShell Mass Exploitation (CVE-2025-53770) Stealing machine keys to maintain persistent access SharePoint -> The exchange server is the next target research.eye.security/sharepoint-und…
10
51
161
65
31K
0
21
59
25
8K
etard_webcam's profile picture. I WAS A 24/7 LIFECASTER: 2006-2017 NOW I JUST SHARE WHATs ON MY MIND = TECH🤓/CYBERSECURITY/GREY HAT HACKER/TRANSHUMANISM/CANNABIS & MY LIFE
E-TARD THE LIFECASTER
 @etard_webcam
Oct 22

"#Chinese Threat Actors #Exploit #ToolShell #SharePoint Flaw Weeks After #Microsoft's July Patch" thehackernews.com/2025/10/chines… I'm sure "FUCK Microsoft!!!!!!" is what many admin's are saying right now. @Microsoft=💩 #Linux =🐧 #CyberSecurityNews #TechNews #Windows #WindowsServer

0
0
2
0
130
0x534c's profile picture. #Cybersecurity #Sentinel #DefenderXDR #KQL #KQLWizard
Steven Lim
@0x534c
Jul 21

Microsoft has issued a security update for SharePoint Subscription Edition which mitigates CVE-2025-53770 and CVE-2025-53771. Defenders should apply the update immediately.🫡 #Cybersecurity #Sharepoint #toolshell microsoft.com/en-us/download…

0x534c's tweet image. Microsoft has issued a security update for SharePoint Subscription Edition which mitigates CVE-2025-53770 and CVE-2025-53771. Defenders should apply the update immediately.🫡 #Cybersecurity #Sharepoint #toolshell microsoft.com/en-us/download…
0
6
23
6
2K
CISACyber's profile picture. Part of @CISAgov, we respond to major incidents, analyze threats, and exchange critical cybersecurity information with partners around the world.
CISA Cyber
 @CISACyber
Jul 20

We added Microsoft SharePoint server remote code execution vulnerability CVE-2025-53770 to our Known Exploited Vulnerabilities Catalog. Visit go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #ToolShell

CISACyber's tweet image. We added Microsoft SharePoint server remote code execution vulnerability CVE-2025-53770 to our Known Exploited Vulnerabilities Catalog. Visit go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #ToolShell
4
55
105
11
14K
TweetThreatNews's profile picture. 🔍 ThreatResearch 📰 CybersecurityNews 🖥️ RansomMonitor 📂 Cyber Attack 📂 Data Breach 🎥 Youtube
Cybersecurity News Everyday
 @TweetThreatNews
Oct 24

Chinese-linked hackers exploited the ToolShell SharePoint vulnerability (CVE-2025-53770) shortly after Microsoft’s patch, targeting telecoms in the Middle East and beyond using loaders like Zingdoor and KrustyLoader. #ToolShell #MiddleEast ift.tt/05a8Uyc

0
0
1
0
184
twelvesec's profile picture. Information security , knowledge sharing, community supporter.
twelvesec
 @twelvesec
Oct 23

China associated #hackers have leveraged the #ToolShell #vulnerability (CVE-2025-53770) in #Microsoft #SharePoint #cyberattacks targeting government agencies, universities, telecommunication service providers, and finance organisations. #CyberSecurity ift.tt/SM98RkY

twelvesec's tweet image. China associated #hackers have leveraged the #ToolShell #vulnerability (CVE-2025-53770) in #Microsoft #SharePoint #cyberattacks targeting government agencies, universities, telecommunication service providers, and finance organisations. #CyberSecurity ift.tt/SM98RkY
0
0
1
0
132
TweetThreatNews's profile picture. 🔍 ThreatResearch 📰 CybersecurityNews 🖥️ RansomMonitor 📂 Cyber Attack 📂 Data Breach 🎥 Youtube
Cybersecurity News Everyday
 @TweetThreatNews
Oct 23

Warlock ransomware surfaced mid-2025 via exploitation of a Microsoft SharePoint zero-day (CVE-2025-53770), linked to China-backed group Storm-2603 using reused stolen certs and DLL sideloading techniques. #China #ToolShell #LockBit ift.tt/lZ8enaR

TweetThreatNews's tweet card. Warlock emerged in June–July 2025 after being deployed via exploitation of the ToolShell Microsoft SharePoint zero-day (CVE-2025-53770) by a China-linked actor tracked as Storm-2603, which also used...
Warlock Ransomware: Old Actor, New Tricks?
Source: hendryadrian.com
0
0
0
0
292
TweetThreatNews's profile picture. 🔍 ThreatResearch 📰 CybersecurityNews 🖥️ RansomMonitor 📂 Cyber Attack 📂 Data Breach 🎥 Youtube
Cybersecurity News Everyday
 @TweetThreatNews
Oct 22

Chinese threat groups Linen Typhoon and Violet Typhoon exploit ToolShell vulnerability to breach governments, telecoms, and universities in Africa and South America, deploying Zingdoor, ShadowPad, and ransomware. #Africa #ToolShell #ChineseEspionage ift.tt/krOFM5q

0
0
0
0
90
omvapt's profile picture. We Secure Risk- Information Security by Consciousness.
omvapt
 @omvapt
Oct 22

#Sharepoint #ToolShell #attacks targeted orgs across four continents ift.tt/SM98RkY

omvapt's tweet image. #Sharepoint #ToolShell #attacks targeted orgs across four continents ift.tt/SM98RkY
0
0
0
0
15
etard_webcam's profile picture. I WAS A 24/7 LIFECASTER: 2006-2017 NOW I JUST SHARE WHATs ON MY MIND = TECH🤓/CYBERSECURITY/GREY HAT HACKER/TRANSHUMANISM/CANNABIS & MY LIFE
E-TARD THE LIFECASTER
 @etard_webcam
Oct 22

"#Chinese Threat Actors #Exploit #ToolShell #SharePoint Flaw Weeks After #Microsoft's July Patch" thehackernews.com/2025/10/chines… I'm sure "FUCK Microsoft!!!!!!" is what many admin's are saying right now. @Microsoft=💩 #Linux =🐧 #CyberSecurityNews #TechNews #Windows #WindowsServer

0
0
2
0
130
BrierandThornMX's profile picture. Una empresa de ciberseguridad y manejo de riesgos de TI.
Brier & Thorn México
 @BrierandThornMX
Oct 22

Actores de amenazas con vínculos con China explotaron la vulnerabilidad de seguridad de #ToolShell en #MicrosoftSharePoint para atacar a una empresa de telecomunicaciones en Medio Oriente. #2025 #Infosec #BT thehackernews.com/2025/10/chines…

BrierandThornMX's tweet card. Chinese threat actors exploited a patched SharePoint flaw, CVE-2025-53770, in global espionage attacks.
Chinese Threat Actors Exploit ToolShell SharePoint Flaw Weeks After Microsoft's July Patch
Source: thehackernews.com
0
0
0
0
1
threatintel's profile picture. Symantec and Carbon Black's threat hunters bring you the latest threat intelligence from the IT security world.
Threat Intelligence
 @threatintel
Oct 22

#ToolShell Used to Compromise Telecoms Company in Middle East - #ZingDoor and #KrustyLoader also used in attacks that hit victims in a variety of countries and sectors. Read more: security.com/threat-intelli…

threatintel's tweet card. China-based threat actors also compromised networks of government agencies in countries in Africa and South America.
ToolShell Used to Compromise Telecoms Company in Middle East
Source: security.com
0
0
0
0
1K
TweetThreatNews's profile picture. 🔍 ThreatResearch 📰 CybersecurityNews 🖥️ RansomMonitor 📂 Cyber Attack 📂 Data Breach 🎥 Youtube
Cybersecurity News Everyday
 @TweetThreatNews
Oct 22

Chinese threat actors exploit the ToolShell vulnerability (CVE-2025-53770) in Microsoft SharePoint, targeting organizations across Middle East, South America, Africa, Europe, and the U.S. using malware like Zingdoor and ShadowPad. #ToolShell #UnitedStates ift.tt/94TGgZL

TweetThreatNews's tweet card. Chinese hacker groups are exploiting the ToolShell vulnerability (CVE-2025-53770) in Microsoft SharePoint to target various global organizations through sophisticated side-loading malware techniques....
Sharepoint ToolShell attacks targeted orgs across four continents
Source: hendryadrian.com
0
0
0
1
149
0xT3chn0m4nc3r's profile picture.
Technomancer
 @0xT3chn0m4nc3r
Oct 22

China-linked hackers exploited SharePoint's ToolShell (CVE-2025-53770) in global attacks on gov, academic, telco, & finance orgs. Read more! bleepingcomputer.com/news/security/… #SharePoint #ToolShell #CyberAttack

0xT3chn0m4nc3r's tweet card. Hackers believed to be associated with China have leveraged the ToolShell vulnerability (CVE-2025-53770) in Microsoft SharePoint in attacks targeting government agencies, universities, telecommunic...
Sharepoint ToolShell attacks targeted orgs across four continents
Source: bleepingcomputer.com
0
0
0
0
63
No results for "#toolshell"
_l0gg's profile picture.
Khoa Dinh
 @_l0gg
Jul 24

Blog for ToolShell Disclaimer: The content of this blog is provided for educational and informational purposes only. blog.viettelcybersecurity.com/sharepoint-too… #SharePoint #ToolShell

_l0gg's tweet image. Blog for ToolShell Disclaimer: The content of this blog is provided for educational and informational purposes only. blog.viettelcybersecurity.com/sharepoint-too… #SharePoint #ToolShell
10
84
247
91
25K
_l0gg's profile picture.
Khoa Dinh
 @_l0gg
Jul 24

Viettel Cyber Security Press Release for Customer alert, Latest research and Recommendations. Blog is comming viettelsecurity.com/microsoft-shar… #SharePoint #ToolShell

_l0gg's tweet image. Viettel Cyber Security Press Release for Customer alert, Latest research and Recommendations. Blog is comming viettelsecurity.com/microsoft-shar… #SharePoint #ToolShell
0
4
26
5
3K
2toLead's profile picture. We are a generous #Microsoft consulting company. Leaders in the #DigitalWorkplace #EmployeeExperience #M365 #SharePoint #Intranet #MSFTViva #MicrosoftCopilot +
2toLead
 @2toLead
Sep 4

#ToolShell gives hackers full control with no passwords needed. Cloud migration isn’t optional. Start with an #intranet audit & content inventory. Learn more 🔗 2tl.co/4mnsO3D #SharePoint #CloudMigration

2toLead's tweet image. #ToolShell gives hackers full control with no passwords needed. Cloud migration isn’t optional. Start with an #intranet audit & content inventory. Learn more 🔗 2tl.co/4mnsO3D #SharePoint #CloudMigration
0
0
0
0
36
twelvesec's profile picture. Information security , knowledge sharing, community supporter.
twelvesec
 @twelvesec
Oct 23

China associated #hackers have leveraged the #ToolShell #vulnerability (CVE-2025-53770) in #Microsoft #SharePoint #cyberattacks targeting government agencies, universities, telecommunication service providers, and finance organisations. #CyberSecurity ift.tt/SM98RkY

twelvesec's tweet image. China associated #hackers have leveraged the #ToolShell #vulnerability (CVE-2025-53770) in #Microsoft #SharePoint #cyberattacks targeting government agencies, universities, telecommunication service providers, and finance organisations. #CyberSecurity ift.tt/SM98RkY
0
0
1
0
132
Inceptionsec's profile picture. Securing SMBs with Microsoft licensing (Defender/Sentinel). Free Inception Foresight M365 assessment: https://t.co/Hp7w9uOKVk
Inception Security
@Inceptionsec
Jul 22

Zero-day #ToolShell is being actively exploited in the wild, targeting on-prem #SharePoint servers with unauth RCE. ⚠️ CVEs: CVE-2025-53770 (RCE) + CVE-2025-53771 (Auth Bypass) 🧠 ToolPane.aspx abused for deserialization & webshells 🔐 Attackers steal MachineKeys, go fileless, &…

Inceptionsec's tweet image. Zero-day #ToolShell is being actively exploited in the wild, targeting on-prem #SharePoint servers with unauth RCE. ⚠️ CVEs: CVE-2025-53770 (RCE) + CVE-2025-53771 (Auth Bypass) 🧠 ToolPane.aspx abused for deserialization & webshells 🔐 Attackers steal MachineKeys, go fileless, &…
0
0
1
0
293
erwandf's profile picture. Co-founder & VP @whaller_fr - LCL (RC) -- Courir plus pour manger plus --
Erwan de FERRIERES
@erwandf
Jul 25

Une faille #SharePoint a touché l’Agence nucléaire 🇺🇸, exploitée via un zero-day par des hackers d’État 🇨🇳. Microsoft a patché, mais l’alerte est orange : environnements on-prem = risque +. Passez le patch #ToolShell dès maintenant. v/@nextinpact ow.ly/Czus50Wv9M0

erwandf's tweet image. Une faille #SharePoint a touché l’Agence nucléaire 🇺🇸, exploitée via un zero-day par des hackers d’État 🇨🇳. Microsoft a patché, mais l’alerte est orange : environnements on-prem = risque +. Passez le patch #ToolShell dès maintenant. v/@nextinpact ow.ly/Czus50Wv9M0
0
0
2
0
93
0x534c's profile picture. #Cybersecurity #Sentinel #DefenderXDR #KQL #KQLWizard
Steven Lim
@0x534c
Jul 21

CISA Adds One Known Exploited Vulnerability, CVE-2025-53770 “ToolShell,” to Catalog cisa.gov/news-events/al… #Cybersecurity #Sharepoint #toolshell

0x534c's tweet image. CISA Adds One Known Exploited Vulnerability, CVE-2025-53770 “ToolShell,” to Catalog cisa.gov/news-events/al… #Cybersecurity #Sharepoint #toolshell
1
17
77
25
5K
EsetJapan's profile picture. ESETは、30年以上にわたりテクノロジーにおける“進化”を”保護”し続けてきました。Progress. Protected.は、私たちESETのストーリーです。 世界中のラボからの最新セキュリティ情報はhttps://t.co/LluwttbQef で公開しています。
ESETJapan（イーセットジャパン）
 @EsetJapan
Jul 31

SharePoint脆弱性を悪用する #ToolShell に注意！🇨🇳中国系攻撃グループによる悪用も報告されていますが、#ESET もLuckyMouseに関連するバックドアを検出。ESETの監視結果はブログで掲載→ htps://www.eset.com/jp/blog/welivesecurity/toolshell-an-all-you-can-eat-buffet-for-threat-actors-jp/

EsetJapan's tweet image. SharePoint脆弱性を悪用する #ToolShell に注意！🇨🇳中国系攻撃グループによる悪用も報告されていますが、#ESET もLuckyMouseに関連するバックドアを検出。ESETの監視結果はブログで掲載→ htps://www.eset.com/jp/blog/welivesecurity/toolshell-an-all-you-can-eat-buffet-for-threat-actors-jp/
1
1
3
0
507
arastuq's profile picture. so many technologies, so little time. visionary at heart, an engineer at scale, and a manager at the chaos.
Touhid Arastu
 @arastuq
Aug 9, 2017

I started learning #React Native today and I want to quite already :D #JavaScript #toolsHell #tehranjs

arastuq's tweet image. I started learning #React Native today and I want to quite already :D #JavaScript #toolsHell #tehranjs
5
3
36
0
0
0x534c's profile picture. #Cybersecurity #Sentinel #DefenderXDR #KQL #KQLWizard
Steven Lim
@0x534c
Jul 24

#ToolShell #Warlock 🚨 KQLWizard intel update: Storm-2603 exploited CVE-2025-53770 on 4 internet-facing SharePoint servers on 22 July, deploying Warlock ransomware via ToolShell. Initial access confirmed via observed hash for IIS_Server_dll.dll (Storm-2603 IIS Backdoor).…

0x534c's tweet image. #ToolShell #Warlock 🚨 KQLWizard intel update: Storm-2603 exploited CVE-2025-53770 on 4 internet-facing SharePoint servers on 22 July, deploying Warlock ransomware via ToolShell. Initial access confirmed via observed hash for IIS_Server_dll.dll (Storm-2603 IIS Backdoor).…
2
31
123
54
9K
Unit42_Intel's profile picture. The latest research and news from Unit 42, the Palo Alto Networks (@paloaltontwks) Threat Intelligence and Security Consulting Team covering incident response.
Unit 42
 @Unit42_Intel
Jul 31

Unit 42 recently identified an unattributed group leveraging the recent #ToolShell exploits to deliver 4L4MD4R #ransomware on July 27th 2025. More info at bit.ly/4l76eL4

Unit42_Intel's tweet image. Unit 42 recently identified an unattributed group leveraging the recent #ToolShell exploits to deliver 4L4MD4R #ransomware on July 27th 2025. More info at bit.ly/4l76eL4
2
18
72
24
12K
Gi7w0rm's profile picture. Threat Intelligence Analyst | See my Linktree for other socials | In case I post false intel, contact me! Support me: https://t.co/5WgDqr0K8p 🇪🇺🇩🇪🇺🇦🌈
Gi7w0rm
 @Gi7w0rm
Jul 23

Quck analysis of new #ToolShell payload observed by @leak_ix: Paylaod is a .dll executed in memory. Sha-256: 3461da3a2ddcced4a00f87dcd7650af48f97998a3ac9ca649d7ef3b7332bd997 It collects System Info and the sensitive machine key. Sends back in response. Single Request takeover.

Gi7w0rm's tweet image. Quck analysis of new #ToolShell payload observed by @leak_ix: Paylaod is a .dll executed in memory. Sha-256: 3461da3a2ddcced4a00f87dcd7650af48f97998a3ac9ca649d7ef3b7332bd997 It collects System Info and the sensitive machine key. Sends back in response. Single Request takeover.
Gi7w0rm's profile picture. Threat Intelligence Analyst | See my Linktree for other socials | In case I post false intel, contact me! Support me: https://t.co/5WgDqr0K8p 🇪🇺🇩🇪🇺🇦🌈
Gi7w0rm
 @Gi7w0rm
Jul 23

⚠️ New payload in the relation to #ToolShell . Attackers now don't need the static file anymore, leaking keys from memory without leaving the file. This means the existence of a file is not a reliable IoC anymore.

1
21
56
11
28K
4
48
153
50
25K
2toLead's profile picture. We are a generous #Microsoft consulting company. Leaders in the #DigitalWorkplace #EmployeeExperience #M365 #SharePoint #Intranet #MSFTViva #MicrosoftCopilot +
2toLead
 @2toLead
Sep 10

🚨 WARNING: Cloud migration isn’t optional! Researchers uncovered #ToolShell, a vulnerability chain giving attackers full control of on-prem #SharePoint. Start with an intranet audit & content inventory to keep your SharePoint secure. Learn more 🔗 2tl.co/4mnsO3D

2toLead's tweet image. 🚨 WARNING: Cloud migration isn’t optional! Researchers uncovered #ToolShell, a vulnerability chain giving attackers full control of on-prem #SharePoint. Start with an intranet audit & content inventory to keep your SharePoint secure. Learn more 🔗 2tl.co/4mnsO3D
0
0
1
0
70
blackorbird's profile picture. Peace and Love. Just Analysis/Hunter/Youtuber/AiCoder/Entrepreneur/. #APT #threatIntelligence #Exploit #CTI #meme #cyber #hacker #OSINT #Ai Need Remote Job
blackorbird
@blackorbird
Jul 25

Attacker IP addresses Update #toolshell welivesecurity.com/en/eset-resear…

blackorbird's tweet image. Attacker IP addresses Update #toolshell welivesecurity.com/en/eset-resear…
blackorbird's profile picture. Peace and Love. Just Analysis/Hunter/Youtuber/AiCoder/Entrepreneur/. #APT #threatIntelligence #Exploit #CTI #meme #cyber #hacker #OSINT #Ai Need Remote Job
blackorbird
@blackorbird
Jul 21

ToolShell Mass Exploitation (CVE-2025-53770) Stealing machine keys to maintain persistent access SharePoint -> The exchange server is the next target research.eye.security/sharepoint-und…

blackorbird's tweet image. ToolShell Mass Exploitation (CVE-2025-53770) Stealing machine keys to maintain persistent access SharePoint -> The exchange server is the next target research.eye.security/sharepoint-und…
10
51
161
65
31K
0
21
59
25
8K
CISACyber's profile picture. Part of @CISAgov, we respond to major incidents, analyze threats, and exchange critical cybersecurity information with partners around the world.
CISA Cyber
 @CISACyber
Jul 20

Malicious actors are exploiting RCE vulnerability CVE-2025-53770 to compromise on-prem SharePoint servers. See our Alert for info & mitigations on exploitation activity, known as #ToolShell. 👉go.dhs.gov/iZZ

CISACyber's tweet image. Malicious actors are exploiting RCE vulnerability CVE-2025-53770 to compromise on-prem SharePoint servers. See our Alert for info & mitigations on exploitation activity, known as #ToolShell. 👉go.dhs.gov/iZZ
4
65
155
27
39K
censysio's profile picture. Censys is the source for real-time Internet intelligence and actionable threat insights for governments, F500 companies, and leading threat intel providers
Censys
@censysio
Jul 21

🔴 CVE-2025-53770 (CVSS 9.8): Critical SharePoint RCE actively exploited as part of #ToolShell 👀 9,762 hosts online (Censys): hubs.ly/Q03y6BW80 🔎@GreyNoiseIO flagged + Censys scans show RDP TCP/3389 using “alikullab1” untrusted cert #CVE202553770 #SharePoint

censysio's tweet image. 🔴 CVE-2025-53770 (CVSS 9.8): Critical SharePoint RCE actively exploited as part of #ToolShell 👀 9,762 hosts online (Censys): hubs.ly/Q03y6BW80 🔎@GreyNoiseIO flagged + Censys scans show RDP TCP/3389 using “alikullab1” untrusted cert #CVE202553770 #SharePoint
4
24
74
25
11K
0x534c's profile picture. #Cybersecurity #Sentinel #DefenderXDR #KQL #KQLWizard
Steven Lim
@0x534c
Jul 21

Microsoft has issued a security update for SharePoint Subscription Edition which mitigates CVE-2025-53770 and CVE-2025-53771. Defenders should apply the update immediately.🫡 #Cybersecurity #Sharepoint #toolshell microsoft.com/en-us/download…

0x534c's tweet image. Microsoft has issued a security update for SharePoint Subscription Edition which mitigates CVE-2025-53770 and CVE-2025-53771. Defenders should apply the update immediately.🫡 #Cybersecurity #Sharepoint #toolshell microsoft.com/en-us/download…
0
6
23
6
2K
wiz_io's profile picture. Secure everything you build and run in the cloud
Wiz
@wiz_io
Jul 21

🚨 Research update: #ToolShell is back, and it just leveled up. Two new vulnerabilities in Microsoft SharePoint Server, CVE-2025-53770 (RCE) and CVE-2025-53771 (auth bypass), are being actively exploited in the wild. 🔓 Attackers are chaining them to >> • Bypass authentication…

wiz_io's tweet image. 🚨 Research update: #ToolShell is back, and it just leveled up. Two new vulnerabilities in Microsoft SharePoint Server, CVE-2025-53770 (RCE) and CVE-2025-53771 (auth bypass), are being actively exploited in the wild. 🔓 Attackers are chaining them to >> • Bypass authentication…
0
6
24
2
3K
threatintel's profile picture. Symantec and Carbon Black's threat hunters bring you the latest threat intelligence from the IT security world.
Threat Intelligence
 @threatintel
Jul 22

Exploitation attempts of the #ToolShell vulnerability have begun to ramp up today. Check out our blog for more: security.com/threat-intelli… #toolshell #CVE_2025_53770

threatintel's tweet image. Exploitation attempts of the #ToolShell vulnerability have begun to ramp up today. Check out our blog for more: security.com/threat-intelli… #toolshell #CVE_2025_53770
0
0
4
0
1K

Something went wrong.


Something went wrong.


United States Trends