Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated July 31)

Unit 42 reports widespread, in-the-wild exploitation of multiple critical on-premises Microsoft SharePoint vulnerabilities (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771) enabling unauthenticated RCE used to install web shells, exfiltrate cryptographic MachineKeys and deliver payloads including 4L4MD4R ransomware; the brief provides IoCs, telemetry (activity timeline and targeting patterns), attribution to CL-CRI-1040/overlap with Storm-2603, and recommended mitigations and hunting queries.