DIVD-2025-00035 - Sharepoint Mass-Exploitation (ToolShell) through CVE-2025-53770

Summary

Attackers are exploiting a new vulnerability in Microsoft SharePoint Server to secretly place a small backdoor on affected servers. This only affects organizations running SharePoint on-premise (local installations), not SharePoint as part of Microsoft 365 (SharePoint Online).

When accessed, this backdoor reveals secret security keys that allow attackers to fully take over the system and bypass normal protections.

What you can do

Either ensure that Microsoft’s Anti-Malware Scan Integration (AMSI) is enabled on your server or take it off the internet completely. Moreoever, check your SharePoint servers for suspicious files with unusual names, such as spinstall0.aspx, and monitor for strange responses when visiting unexpected pages. If you suspect that your server has been compromised, you should change all security keys and credentials, investigate for further unauthorized access, and consider restoring from a clean backup.

What we are doing

DIVD is currently working to identify on-premise SharePoint instances that have been compromised through CVE-2025-53770. We use data from multiple sources, including Shodan, Censys, and NetLas.io, to locate potentially vulnerable SharePoint instances. We then perform our own targeted scans to detect signs of active exploitation—specifically the presence of webshells or other malicious implants.

Once a potential compromise is confirmed, we notify the affected organizations either directly or via trusted third parties, depending on the available contact information and responsible disclosure channels.

Timeline

More information

• Eye Security blogpost
• Vulnerability advisory Microsoft
• Customer Guidance - Microsoft
• CVE-2025-53770