Executive Summary

In mid-2025, hackers uncovered a hidden flaw in Microsoft SharePoint , a tool widely used for file sharing and teamwork. Criminals quickly turned this weakness, known as a zero-day, into a powerful attack method called the ToolShell exploit chain.

The result? Over 400 organizations worldwide, including South Africa’s National Treasury, were breached in one of the year’s largest cyberattacks.

This blog explains how the attack unfolded, why it spread so fast, and the key lessons every organization should take away to stay protected.

Background & Context

About Microsoft SharePoint

SharePoint is a widely used Microsoft platform for enterprise collaboration, content management, and document sharing. It integrates with Microsoft 365 services and is often deployed in both on-premises and cloud environments.

In June 2025, a zero-day vulnerability was discovered in on-premises SharePoint servers. This vulnerability was actively exploited before Microsoft released fixes.

Nature of the Exploit

The vulnerability in this incident allowed remote attackers to bypass authentication and execute arbitrary code on the targeted SharePoint servers. This was achieved by chaining multiple CVEs:

How the ToolShell Attack Unfolded

This diagram outlines the ToolShell exploit chain used in the SharePoint breach. Attackers began with reconnaissance, scanning for unpatched SharePoint servers exposed to the internet. They gained initial access by exploiting CVE-2025-49704 (Remote Code Execution) and CVE-2025-49706 (Authentication Bypass), allowing admin-level entry without credentials. A malicious ASPX webshell, such as spinstall0.aspx, was then deployed to enable persistent remote command execution. Through this webshell, adversaries established command-and-control (C2) communications, exfiltrated data, and deployed post-exploitation tools like Mimikatz for credential harvesting and lateral movement. The intrusion concluded with persistence mechanisms backdoors, scheduled tasks, and policy changes and, in some cases, ransomware deployment.

Incident Discovery

The breach at the National Treasury didn’t start with flashing alarms or instant chaos , it began quietly. In mid-June 2025 , security teams around the world started whispering about strange activity on Microsoft SharePoint servers. No one knew it yet, but a brand-new flaw — a zero-day was being exploited.

Mid-May 2025 - Vulnerability Demonstrated at Pwn2Own Berlin

At the Pwn2Own Berlin security contest, researcher Dinh Ho Anh Khoa of Viettel Cyber Security successfully exploited Microsoft SharePoint by chaining an authentication bypass with an insecure deserialization vulnerability, achieving remote code execution (RCE). This proof-of-concept, later linked to the ToolShell exploit chain, earned him $100,000 and 10 Master of Pwn points. Although conducted in a controlled competition environment, the demonstration revealed a serious weakness that would soon be weaponized in real-world attacks.

July 7, 2025 - First Real-World Exploitation Detected

Check Point Research reported the earliest known in-the-wild exploitation of the ToolShell vulnerability (CVE-2025-53770) in Microsoft SharePoint on-premises servers. This marked the shift from theoretical proof-of-concept attacks to active campaigns targeting live corporate environments. The attacks exploited the zero-day flaw to gain unauthorized access, enabling remote code execution and posing a critical risk to organizations worldwide.

July 19, 2025 - Microsoft Confirms Active Exploitation

Microsoft issued a public security advisory confirming that on-premises SharePoint Server customers were under active attack through vulnerabilities, including CVE-2025-53770 and CVE-2025-53771. The company noted that these flaws had only been partially addressed in the initial July Security Update and urged customers to immediately apply the newly released patches to fully mitigate the threat.

July 24, 2025 - National Treasury Confirms Malware Intrusion

The National Treasury of South Africa announced it had detected malware on its Infrastructure Reporting Model (IRM) website, part of its online infrastructure monitoring system. The affected servers were immediately isolated for forensic analysis, and Microsoft was called in to help identify and address potential vulnerabilities. While Treasury confirmed links to the ongoing global SharePoint zero-day campaign, it reported no disruption to public services.

The Treasury’s ICT department processes over 200,000 emails daily and facilitates more than 400,000 user connections to its websites. On average, the ICT team blocks approximately 5,800 security threats every day, ranging from phishing attempts and malware infections to spam attacks. This incident, however, stood out as one of the most serious due to its confirmed connection with a global exploitation wave.

Late July 2025 - Global Scale Confirmed

Cybersecurity firm Eye Security reported identifying large-scale exploitation of the SharePoint remote code execution (RCE) vulnerability chain (CVE-2025-49704 & CVE-2025-49706) in the wild. Their scans covered over 23,000 SharePoint servers worldwide, revealing more than 400 systems actively compromised across four distinct attack waves. Victims spanned multiple regions including South Africa, Mauritius, Jordan, the United States, and EU countries impacting government bodies, universities, and private enterprises. This confirmation solidified the ToolShell campaign as one of the most widespread SharePoint exploitation events in recent years.

Lessons learned

Be Ready Before the Patch Exists

The ToolShell incident proved that attackers can exploit unknown flaws before vendors release patches. Organizations must have an action plan for rapid containment including isolating systems, enabling heightened monitoring, and communicating clearly with stakeholders even before a fix is available.

A “Fixed” System Can Still Be Broken

Microsoft’s initial July update addressed the flaw only partially, which attackers continued to exploit. This shows that security teams must track follow-up vendor guidance after a patch and treat “partial” fixes as urgent vulnerabilities, not closed issues.

Spotting Trouble Early Saves Systems

Treasury’s ability to detect suspicious activity through routine log reviews and traffic monitoring was key to avoiding service disruption. Early detection tools like EDR and SIEM give defenders precious hours or days to react before attackers achieve deeper compromise.

Preventive Measures & Best Practices

Patch Fast, Patch Smart

Maintain a rapid update process for critical systems like SharePoint. Use staging environments for quick testing, but don’t delay production deployment of high-severity patches.

Restrict and Monitor Access

Limit SharePoint admin and service account privileges, enforce MFA, and restrict external access to critical endpoints. Pair this with continuous monitoring of failed logins, suspicious requests, and unusual file uploads.

Defend in Layers

Combine perimeter defenses (WAF, firewall rules) with host-level detection (EDR, anti-malware) and network-level visibility (IDS/IPS) to spot exploitation attempts at multiple stages of the attack chain.

Final Thoughts

The ToolShell campaign was a wake-up call that modern cyberattacks move faster than traditional defenses. A single unpatched system can become the entry point for a global breach within hours. In an era of zero-days and nation-state threats, speed, visibility, and collaboration are not luxuries , they are survival tools.