Team Cymru: SharePoint ToolShell Exploitation Preceded Public PoC by Three Days
Summary
Team Cymru says it observed live SharePoint ToolShell exploitation on July 18, 2025, three days before the first GitHub PoC. Its analysis argues exploitation often starts within hours of public PoC release and recommends faster patching.
Key points
- Team Cymru reports observing live exploitation of on-premises SharePoint servers on July 18, 2025; the first PoC exploit code was posted publicly on GitHub on July 21.
- Tracking activity across six recent high-profile vulnerabilities, Team Cymru found average time to exploitation was just under four hours; it says activity sometimes began before public PoC code appeared.
- Microsoft reported that Linen Typhoon, Violet Typhoon, and Storm-2603 exploited the vulnerabilities. Microsoft assessed Storm-2603 as China-based with medium confidence.
- Team Cymru says access and techniques can circulate between threat groups, and compares the pattern to the 2021 Hafnium Microsoft Exchange incident.
- The article recommends prioritizing exposed, business-critical systems, improving real-time asset awareness, and compressing patch cycles for external systems to under 24 hours.
Article Details
- Topic
- ToolShell exploitation of on-premises SharePoint and the need for faster vulnerability patching
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | c34718cbb4c6[.]ngrok-free[.]app | Listed as a ToolShell-related indicator in the article's Indicators Source section. |
| IPV4 | 103[.]186[.]30[.]186 | Listed as a ToolShell-related indicator in the article's Indicators Source section. |
| IPV4 | 104[.]238[.]159[.]149 | Listed as a ToolShell-related indicator in the article's Indicators Source section. |
| IPV4 | 107[.]191[.]58[.]76 | Listed as a ToolShell-related indicator in the article's Indicators Source section. |
| IPV4 | 131[.]226[.]2[.]6 | Listed as a ToolShell-related indicator in the article's Indicators Source section. |
| IPV4 | 134[.]199[.]202[.]205 | Listed as a ToolShell-related indicator in the article's Indicators Source section. |
| IPV4 | 172[.]174[.]82[.]132 | Listed as a ToolShell-related indicator in the article's Indicators Source section. |
| IPV4 | 188[.]130[.]206[.]168 | Listed as a ToolShell-related indicator in the article's Indicators Source section. |
| IPV4 | 45[.]77[.]155[.]170 | Listed as a ToolShell-related indicator in the article's Indicators Source section. |
| IPV4 | 96[.]9[.]125[.]147 | Listed as a ToolShell-related indicator in the article's Indicators Source section. |
MITRE ATT&CK
CVE
People
Threat Actors
APT31Microsoft assessed that this China-nexus group was observed exploiting the SharePoint vulnerabilities; the article identifies APT31 as an alias of Violet Typhoon.Emissary PandaMicrosoft assessed that this China-nexus group was observed exploiting the SharePoint vulnerabilities; the article identifies Emissary Panda as an alias of Linen Typhoon.Linen TyphoonMicrosoft assessed that this China-nexus group was observed exploiting the SharePoint vulnerabilities; the article identifies APT27 and Emissary Panda as aliases.SHORE CASTLEMicrosoft assessed that this China-nexus group was observed exploiting the SharePoint vulnerabilities; the article identifies APT27 as an alias of Linen Typhoon.Storm-2603Microsoft assessed with medium confidence that this China-based adversary was observed exploiting the SharePoint vulnerabilities.Violet TyphoonMicrosoft assessed that this China-nexus group was observed exploiting the SharePoint vulnerabilities; the article identifies APT31 and Judgement Panda as aliases.
Vendors
MicrosoftThis week’s zero-day exploit targeting Microsoft SharePoint, now referred to as ToolShell, caught organizations off guard. The exploit allowed unauthenticated remote code execution and quickly spread across unpatchedTeam Cymruit does highlight a trend we’ve been monitoring for several years - evidence of exploitation within Team Cymru’s data holdings prior to the availability of public exploit code. This type of insight is critical
Products
Microsoft SharePointThis week’s zero-day exploit targeting Microsoft SharePoint, now referred to as ToolShell, caught organizations off guard. The exploit allowed unauthenticated remote code execution and quickly spread across unpatchedScoutFor customers of our Scout product, a handy search to identify Sharepoint instances of interest is openports.banner.regex = "MicrosoftSharePointTeamServices"