Chinese Hackers Using ToolShell Vulnerability To Compromise Networks Of Government Agencies

China-based threat actors have exploited the critical ToolShell vulnerability in Microsoft SharePoint servers to infiltrate networks across multiple continents, targeting government agencies and critical infrastructure in a suspected espionage campaign.

This vulnerability, identified as CVE-2025-53770, enables unauthenticated remote code execution and has been actively used since its disclosure in July 2025, despite Microsoft’s rapid patching efforts.

Security researchers from Symantec report that the attacks began shortly after patches were released, affecting organizations in the Middle East, Africa, South America, and beyond.

ToolShell stems from a deserialization of untrusted data issue in on-premises SharePoint servers, allowing attackers to execute arbitrary code without authentication.

It builds on earlier flaws like CVE-2025-49704 and CVE-2025-49706, which were demonstrated at the Pwn2Own Berlin event in May 2025.

The exploit chain typically involves an authentication bypass (CVE-2025-53771), where a crafted POST request to the ToolPane.aspx endpoint tricks the server into granting access, followed by injecting malicious payloads for code execution.

Microsoft confirmed exploitation by at least three Chinese-linked groups Budworm (Linen Typhoon), Sheathminer (Violet Typhoon), and Storm-2603 shortly after patching on July 21, 2025.

These actors have leveraged ToolShell for zero-day attacks, compromising file systems and enabling persistent access.

Targets And Attack Patterns

The campaign’s scope is broad, with confirmed breaches in a Middle Eastern telecom firm, two African government departments, South American agencies, a U.S. university, an African state technology entity, a Middle Eastern government department, and a European finance company.

Initial access in the Middle East occurred on July 21, 2025, via a webshell deployment, followed by DLL sideloading of malware using legitimate binaries from Trend Micro and BitDefender.

In South American cases, attackers exploited SQL and Apache HTTP servers with Adobe ColdFusion, using a renamed “mantec.exe” to mimic Symantec tools and sideload malicious DLLs.

Evidence points to mass scanning for vulnerable servers, with selective follow-up on high-value targets for credential theft and lateral movement.

The attackers deployed Zingdoor, a Go-based HTTP backdoor linked to the Glowworm group (aka Earth Estries or FamousSparrow), first documented in 2023 for espionage against government and tech sectors.

ShadowPad, a modular RAT associated with APT41-nexus groups like Blackfly, was also used via DLL sideloading for command execution and updates.

KrustyLoader, a Rust-written loader tied to UNC5221 (a China-nexus actor), delivered second-stage payloads like Sliver, an open-source C2 framework abused for red-team emulation.

Living-off-the-land tools included Certutil for downloads, Procdump and LsassDumper for credential dumping, GoGo Scanner for reconnaissance, Revsocks for proxying, and the PetitPotam exploit (CVE-2021-36942) for privilege escalation.

IoCs

This activity highlights ToolShell’s widespread abuse beyond initial reports, underscoring the need for urgent patching of on-premises SharePoint instances.

With over 400 compromises detected and links to Salt Typhoon tactics, the operations suggest state-sponsored espionage focused on persistent, stealthy network access.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.