Sharepoint ToolShell attacks targeted orgs across four continents

Symantec reports that the ToolShell SharePoint zero-day (CVE-2025-53770) has been actively exploited by Chinese-linked threat groups to compromise government, telecom, finance, and academic organizations worldwide; attackers used webshells and DLL side‑loading to deploy Zingdoor, ShadowPad, KrustyLoader, and the Sliver framework, and performed credential dumping and PetitPotam-based domain compromise, while Microsoft released emergency updates to address the on‑premises SharePoint flaw.