ToolShell
ToolShell is the name used for an exploit chain targeting on-premises Microsoft SharePoint Server, and in some reporting it is also described as being named after a custom remote access trojan/webshell used in the campaign. The activity targets internet-facing on-prem SharePoint Server 2016, 2019, and Subscription Edition systems and enables unauthenticated or authentication-bypass-assisted remote code execution through chained SharePoint vulnerabilities including CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771. Microsoft, CISA, CrowdStrike, Cisco, and other reporting cited in the content associate ToolShell exploitation with China-linked actors Linen Typhoon, Violet Typhoon, and Storm-2603; Storm-2603 is additionally linked to ransomware deployment including WarLock/Warlock, LockBit Black/X2anylock, and related financially motivated follow-on activity.
Observed ToolShell tradecraft includes POST requests to SharePoint ToolPane endpoints such as /_layouts/15/ToolPane.aspx and /_layouts/16/ToolPane.aspx, abuse of the MSOtlPn_DWP parameter and CompressedDataTable payloads, deserialization-based code execution, and deployment of malicious ASPX files including spinstall0.aspx, spinstallb.aspx, spinstallp.aspx, and info3.aspx. Reported payloads and artifacts include Base64-encoded .NET DLLs such as bjcloiyq.dll, osvmhdfl.dll, and jlaneafi.dll. These components were used to extract ASP.NET/SharePoint MachineKey material, gather host and environment information, write additional webshells into SharePoint layouts directories, execute commands via cmd.exe or powershell.exe, and support file upload. Multiple reports state that attackers stole MachineKey values including ValidationKey and DecryptionKey to maintain persistence, evade remediation, and potentially forge authentication or session tokens even after patching.
The campaign affected hundreds of organizations globally, including government, defense, telecommunications, academic, nonprofit, critical infrastructure, and private-sector entities. Reported victims included U.S. federal and state agencies and other governments in Europe and the Middle East. Follow-on activity described in the content includes lateral movement, credential theft, Defender disabling, use of PsExec and Impacket, in-memory payload delivery to evade EDR, and ransomware deployment. High-confidence indicators mentioned in the content include suspicious ToolPane POST requests, follow-on requests to spinstall0.aspx, payloads around 7000-8000+ bytes, the X-TXT-NET response header used to return stolen machine-key data, suspicious strings such as ysoserial and -EncodedCommand, and infrastructure/IPs including 107.191.58.76, 104.238.159.149, 96.9.125.147, 103.186.30.186, 45.77.155.170, 139.144.199.41, 172.174.82.132, 89.46.223.88, update.micfosoft[.]com, dynastyjusticecollective.site, and theinnovationfactory[.]it (145.239.97[.]206).
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
According to Microsoft, cyber threat actors have chained CVE-2025-49706 (a network spoofing vulnerability) and CVE-2025-49704 (a remote code execution (RCE) vulnerability) in an exploit chain known as “ToolShell” to gain unauthorized access to on-premise SharePoint servers.
According to Microsoft, cyber threat actors have chained CVE-2025-49706 (a network spoofing vulnerability) and CVE-2025-49704 (a remote code execution (RCE) vulnerability) in an exploit chain known as “ToolShell” to gain unauthorized access to on-premise SharePoint servers.
According to Microsoft, cyber threat actors have chained CVE-2025-49706 (a network spoofing vulnerability) and CVE-2025-49704 (a remote code execution (RCE) vulnerability) in an exploit chain known as “ToolShell” to gain unauthorized access to on-premise SharePoint servers.
According to Microsoft, cyber threat actors have chained CVE-2025-49706 (a network spoofing vulnerability) and CVE-2025-49704 (a remote code execution (RCE) vulnerability) in an exploit chain known as “ToolShell” to gain unauthorized access to on-premise SharePoint servers.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
According to Microsoft, cyber threat actors have chained CVE-2025-49706 (a network spoofing vulnerability) and CVE-2025-49704 (a remote code execution (RCE) vulnerability) in an exploit chain known as “ToolShell” to gain unauthorized access to on-premise SharePoint servers.
According to Microsoft, cyber threat actors have chained CVE-2025-49706 (a network spoofing vulnerability) and CVE-2025-49704 (a remote code execution (RCE) vulnerability) in an exploit chain known as “ToolShell” to gain unauthorized access to on-premise SharePoint servers.
According to Microsoft, cyber threat actors have chained CVE-2025-49706 (a network spoofing vulnerability) and CVE-2025-49704 (a remote code execution (RCE) vulnerability) in an exploit chain known as “ToolShell” to gain unauthorized access to on-premise SharePoint servers.
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Additional analysis determined these events are likely the result of active, malicious deployment of an exploit leveraging ‘ToolShell.’ ... ToolShell collectively refers to the chained exploitation of two SharePoint vulnerabilities ... threat actors are in fact using ToolShell to exploit a new 0-day vulnerability
Stealth
1 technique
Stealth
IOCs tracked for this family
58 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Exploit chain against on-prem Microsoft SharePoint enabling unauthenticated RCE; observed used as a zero-day in targeted incidents against North American government orgs.
Referenced as a prior-quarter exploitation surge involving public-facing applications; specific functionality not described in this content.
ToolShell is an exploit tool used to target Microsoft SharePoint via CVE-2025-53770, enabling unauthenticated remote code execution through crafted POST requests.
ToolShell refers to a coordinated exploitation campaign targeting Microsoft SharePoint vulnerabilities (CVE-2025-49704, CVE-2025-49706, and their bypasses) by multiple Chinese threat actors for initial access, espionage, and in some cases, ransomware deployment.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.