Top Tweets for #ToolShell
Patched #SharePoint after #ToolShell? You may still be exposed.
The suspected China-nexus actor behind #Warlock ransomware (Longlegs / Storm-2603) is still breaking into on-prem SharePoint more than a year later. Recent victims include a water utility, a telecom provider, a regional government body, and a university across Portuguese- and Spanish-speaking countries.
How they operate:
→ Exploit SharePoint, then drop web shells
→ Steal ASP. NET machine keys and forge signed payloads for RCE
→ Kill EDR via BYOVD (K7RKScan.sys, CVE-2025-1055)
→ Hide remote access inside VS Code tunnels
→ Stage ransomware in SYSVOL and let domain replication deploy it
In one intrusion, #EDR was disabled on 40+ hosts in about 2 hours, and ransomware hit 33+.
What to do now:
1Patch, then rotate ASP. NET machine keys and restart IIS. Stolen keys survive patching.
2Hunt for web shells in SharePoint LAYOUTS directories.
3Enforce the vulnerable driver blocklist / HVCI.
4Block VS Code tunnels on servers.
5Alert on executables written to SYSVOL.
Your detection window is hours, not days.
Source: #Symantec Threat Hunter Team
#ThreatIntel #Ransomware #SharePoint #CyberSecurity
https://t.co/A82Nqu3w3Y
🚨 The top #CVEs of #2025 weren’t just severe - they were exploited fast.
From #React2Shell to #ToolShell & #CitrixBleed2, attackers weaponized flaws before many orgs could #patch.
📊 https://t.co/kAxe1F3q36
新報告：SharePointのToolShell脆弱性 (CVE-2025-53770/53771) を狙い、Webシェルではなくインメモリ実行型ペイロードが使われている。ネットワークログ＆PCAPでのハンティング必須。#SharePoint #ToolShell #SANSISC https://t.co/ch0bKG6FLy
"#Chinese Threat Actors #Exploit #ToolShell #SharePoint Flaw Weeks After #Microsoft's July Patch"
https://t.co/ekPPvYhFvU
I'm sure "FUCK Microsoft!!!!!!" is what many admin's are saying right now.
@Microsoft=💩
#Linux =🐧
#CyberSecurityNews #TechNews #Windows #WindowsServer
#Warlock #ransomware: Old actor, new tricks? - #ToolShell vuln used in attacks by China-based actor. Read more: https://t.co/1wOh2tZxmh
#ToolShell Used to Compromise Telecoms Company in Middle East - #ZingDoor and #KrustyLoader also used in attacks that hit victims in a variety of countries and sectors. Read more: https://t.co/xFZyjrnoRo
Storm-2603 milks ToolShell: CISA flags SharpyShell; Warlock hitting unpatched SharePoint. Rotate machine keys & patch now. 🔓🐼
Read: https://t.co/A0WUzGV5Sr
#AlphaHunt #CyberSecurity #ToolShell
#ThreatProtection #ProjectAK47 malware links threat actor to #ToolShell activity, read more about Symantec's coverage: https://t.co/H2v9imYQyi
We’ve released a Malware Analysis Report with analysis & detection signatures on files related to Microsoft SharePoint vulnerabilities known as #ToolShell. Review IOCs and detection signatures in our 🆕report 👉 https://t.co/W7EvST0x6e
#WeeklyThreats: Le ultime sugli attacchi basati su #ToolShell, gruppi #cybercrime colpiscono realtà italiane, forniti nuovi dettagli circa #APT russi e cinesi.
L'ultima settimana nel nostro report #OSINT e #CTI
🔗 https://t.co/hr4xm66wa1
@TelsyGruppoTIM #ThreatIntelligence
New cyber threat: ToolShell is exploiting #SharePoint flaws (CVE-2025-53770 & CVE-2025-53771) for full server access — no login needed.
Learn how it works + how to defend against it:
Critical Cyber Update: https://t.co/pzkn6AelYy
#Cybersecurity #MatriumInsights #ToolShell
#Storm2603, a suspected China-based #ThreatActor, is exploiting Microsoft SharePoint #ToolShell #vulnerability to deploy #WarlockRansomware. They use a custom command-and-control framework, #AK47C2, with HTTP and DNS clients. #onpatrol4malware
https://t.co/YLvgyh4ZOM
‼️ #ToolShell: Ricostruzione di una catena di attacco post-compromissione di #SharePoint
🔗 https://t.co/Dvprk3KABc
👉 Report di #Analisi #Forense a cura dello #CSIRT_ITalia
17000以上のオンプレミス SharePoint サーバが公開され、840台がゼロデイ（CVE‑2025‑53770）に未対応。400以上の組織が侵害され、20台以上にwebshell検出。中国系グループが攻撃主導。#ToolShell #SharePointRisk https://t.co/hHiVqd2gwn
Check out our latest episode of Practical Protection: SharePoint and ToolShell https://t.co/Hcem7VZgLX @paulrobichaux
#ToolShell #Sharepoint #vulnerability #Security
Unit 42 recently identified an unattributed group leveraging the recent #ToolShell exploits to deliver 4L4MD4R #ransomware on July 27th 2025. More info at https://t.co/rBfy0QNsSL
#CeSIAnalysis - L’operazione cibernetica #toolshell ha colpito oltre 400 entità, incluse agenzie governative USA, evidenziando la vulnerabilità degli #assetdigitali strategici e la crescente complessità della #hybridwarfare.
🔗https://t.co/jnTtFVW64V.
"Mimo" Gang used #Sharepoint #ToolShell to deliver "4l4md4r" #ransomware, which is written in Go language and contains religious-style function names.
Report: https://t.co/vALsXlGM0G
كاسبرسكي: ثغرات “SharePoint” الجديدة مرتبطة بإصلاح غير مكتمل منذ 2020
#البوابة_التقنية
#تقنية #كاسبرسكي #الأمن_السيبراني #مايكروسوفت
#Microsoft365 #SharePoint #ToolShell
https://t.co/nAYXgpiUS4
El equipo de #ESETResearch ha estado monitoreando una serie de ataques que explotan las #vulnerabilidades zero-day recientemente descubiertas en Microsoft SharePoint, conocidas como #ToolShell https://t.co/Ll01itPmgy vía @ESETLA
Last Seen Hashtags on Sotwe
Trends for you
Most Popular Users
Elon Musk 
@elonmusk
241.5M followers
Barack Obama
@barackobama
118.8M followers
Cristiano Ronaldo
@cristiano
114.5M followers
Donald J. Trump
@realdonaldtrump
111.9M followers
Narendra Modi
@narendramodi
107.1M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.3M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.5M followers
Kim Kardashian
@kimkardashian
70.9M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.5M followers
Bill Gates
@billgates
65.2M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.2M followers
CNN
@cnn
61.7M followers
X
@x
60.7M followers