Parasitic Sharepoint Exploits, (Mon, Jul 28th)

The report describes active exploitation of on‑premises SharePoint vulnerabilities beginning in mid‑July 2025, with attackers dropping and later leveraging various backdoor .aspx files (notably spinstall0.aspx). Honeypot telemetry shows numerous requests and a timeline of discovered backdoor paths and first-seen dates, and Microsoft has published guidance on disrupting the exploitation.