The ToolShell exploit, affecting on-premises Microsoft SharePoint servers, has driven a rise in threat actors exploiting public-facing applications for initial access.
In the last quarter, this tactic appeared in over 60% Cisco Talos Incident Response (Talos IR) engagements, an increase from 10% in the previous quarter.
Almost 40% of all engagements involved ToolShell activity, majorly contributing to this tactic’s rise in popularity, Cisco Talos explained in a recent report.
The ToolShell exploit chain was first made public in mid-July 2025. The attack sees CVE-2025-53770 and CVE-2025-53771, two critical and high-severity vulnerabilities in internet-facing SharePoint servers, exploited.
In July 2025, Microsoft warned that Chinese-based threat groups, Linen Typhoon and Violet Typhoon, were actively targeting the SharePoint vulnerabilities. This is likely part of a strategic campaign to gain initial access to targets across government, defense, academia and NGOs.
Active exploitation of the ToolShell vulnerabilities was first observed in the wild on July 18, a day before Microsoft issued its emergency advisory.
“Almost all Talos IR engagements responding to ToolShell activity kicked off within the following 10 days,” Cisco explained in its Quarterly Trends report, published on October 23.
Read more: US Tops Hit List as 396 SharePoint Systems Compromised Globally
Network Segmentation Crucial
The cybersecurity firm highlighted the need for network segmentation to prevent these attacks enabling threat actors to laterally move within an organization.
In one engagement by the Talos IR, the firm said the victim organization was impacted by ToolShell exploitation against a SharePoint server, then experienced a ransomware attack a few weeks later.
In the ransomware attack, Talos IR analysis indicated the actors transferred credential stealing malware from the affected public-facing SharePoint server to a SharePoint database server on the victim’s internal network.
This, Talos IR said, demonstrates how they leveraged the trusted relationship between the two servers to expand their foothold.
Ransomware Remains a Persistent Threat
Other findings in the Cisco Talos update showed that ransomware incidents made up around 20% of engagements in the third quarter of 2025, down from 50% in the previous quarter.
Talos IR responded to Warlock, Babuk and Kraken ransomware variants for the first time, while also responding to previously seen families Qilin and LockBit.
The company responded to a ransomware engagement in Q3 that it assessed with moderate confidence was attributable to the Storm-2603 threat group based on overlapping techniques, tactics and procedures (TTPs), such as the deployment of both LockBit and Warlock ransomware.
The Qilin ransomware group were also particularly active, and Cisco Talos said it will very likely continue to be a top ransomware threat through at least the remainder of 2025, pending any disruption or intervention.
Image credit: PhotoGranary02 / Shutterstock.com
