Story perspectives

ToolShell Campaign Exploits Microsoft Vulnerabilities, Ransomware Surges

7/29/2025

43 5

Summary

Story summary

The "ToolShell" campaign targets Microsoft SharePoint servers, exploiting vulnerabilities CVE-2025-49704 and CVE-2025-49706.
Attackers gain unauthorized access by bypassing authentication, impacting sectors in Egypt, Russia, and Vietnam.
Ransomware attacks, including Warlock, are on the rise, with groups exploiting known vulnerabilities despite existing Microsoft patches.
Security experts recommend immediate updates and continuous monitoring to reduce risks from ongoing threats.

1 of 1

Story summary

The "ToolShell" campaign targets Microsoft SharePoint servers, exploiting vulnerabilities CVE-2025-49704 and CVE-2025-49706.
Attackers gain unauthorized access by bypassing authentication, impacting sectors in Egypt, Russia, and Vietnam.
Ransomware attacks, including Warlock, are on the rise, with groups exploiting known vulnerabilities despite existing Microsoft patches.
Security experts recommend immediate updates and continuous monitoring to reduce risks from ongoing threats.