SOC Incident Analysis Exposes Active Exploitation of CVE-2025-53770 SharePoint ToolShell Auth Bypass and RCE
A detailed walkthrough of Letsdefend SOC342 demonstrates how analysts detected and confirmed exploitation of CVE-2025-53770 targeting SharePoint servers. The alert was triggered by a suspicious unauthenticated POST request to ToolPane.aspx carrying an unusually large payload and a spoofed referer. Investigation revealed that the vulnerable server accepted the request, after which PowerShell commands extracted ASP.NET cryptographic keys, enabling ViewState forgery and remote code execution. Attackers then compiled and dropped additional payloads using csc.exe and created a malicious spinstall0.aspx page that leveraged WScript.Shell to download further malware. Network indicators included the malicious IP 107.191.58.76 flagged by CISA and multiple VirusTotal detections. The server was isolated, files removed, and cryptographic keys rotated to contain the breach.
HabrJul 28, 2026Translated from Russian
