Many organisations still run SharePoint on their own servers because it holds their documents and they want them close. In July 2025 that choice became an emergency: a chain of flaws let attackers take over internet-facing servers and steal the keys that keep them secure.
What happened
In May 2025, researchers demonstrated a chain of SharePoint vulnerabilities at the Pwn2Own Berlin hacking contest. Microsoft released patches on 8 July. But attackers found a way around them. Microsoft says the first exploitation attempts began on 7 July, and on the evening of 18 July the security firm Eye Security spotted large-scale exploitation of a new variant, later tracked as CVE-2025-53770 and nicknamed "ToolShell".
The US cybersecurity agency CISA added the flaw to its list of known exploited vulnerabilities on 20 July. Microsoft attributed the activity to two Chinese state-linked groups, Linen Typhoon and Violet Typhoon, and to a China-based group it tracks as Storm-2603, which used the access to deploy Warlock ransomware. Eye Security's chief technology officer reported at least 400 infected servers and 148 breached organisations. The US Department of Energy said it was "minimally impacted". In the UK, the NCSC said a limited number of organisations had been affected.
How the attack worked
Attackers sent a crafted request to a SharePoint page and uploaded a small web shell. That file read the server's ASP.NET machine keys, the cryptographic secrets SharePoint uses to trust its own data. With those keys, attackers can forge trusted requests and keep access even after the server is patched.
That is why CISA's advice was unusual: "Rotate ASP.NET machine keys, then after applying Microsoft's security update, rotate ASP.NET machine keys again." Patching closed the door, but anyone already inside still held a key.
Only on-premises servers were affected. Microsoft confirmed that SharePoint Online in Microsoft 365 was not.
Why it matters for your organisation
On-premises SharePoint and similar document systems are common in organisations that want control over where sensitive files live. That control comes with a responsibility: when a critical flaw is published, you have days, sometimes hours, to patch, check for compromise and rotate secrets. Organisations without dedicated security staff often find out weeks later.
Servers that are reachable from the internet "just for remote access" are the ones attackers scan for first.
What to do now
The NCSC's guidance was direct: "These updates should be applied immediately." Beyond that:
- Know what is exposed. List every server reachable from the internet, including document, email and remote access systems.
- Patch, rotate and check. For critical flaws, apply updates, rotate keys and credentials, and look for signs of compromise rather than assuming you were missed.
- Turn on built-in protections such as AMSI integration and endpoint detection on servers, as Microsoft and the NCSC recommend.
- Retire unsupported versions. CISA advised disconnecting end-of-life SharePoint servers from the internet.
- Reconsider hosting. Decide deliberately whether a managed cloud service or a hardened private cloud gives better security for your size.
How Blacknote helps
Our Infrastructure Security & Hardening project finds what your organisation exposes to the internet, closes the riskiest paths and sets up a patch and response routine. Where it makes sense, we plan a secure migration, for example to a hardened European cloud such as Hetzner.
Sources
- Microsoft Security: Disrupting active exploitation of on-premises SharePoint vulnerabilities
- CISA: Microsoft releases guidance on exploitation of SharePoint vulnerabilities
- NCSC: Active exploitation of vulnerability affecting Microsoft SharePoint Server products in the UK
- BleepingComputer: US nuclear weapons agency reportedly hacked in SharePoint attacks
- Tenable: CVE-2025-53770 frequently asked questions