Scattered Spider and the Help Desk: When Social Engineering Beats Your Firewall
July 15, 2025When the House of Commons Got Hit: DFIR Lessons From a National Breach
August 19, 2025In late July 2025, active exploitation of on-premises Microsoft SharePoint Server put a large number of organizations into incident-response mode almost overnight. The exploit chain, widely tracked under the ToolShell name and tied to CVE-2025-53770 and related flaws, allowed unauthenticated remote code execution against internet-facing SharePoint. Attackers used it to steal cryptographic machine keys and plant web shells, which meant a single missed patch could translate into persistent, hard-to-evict access.
Why This One Mattered
Three factors made ToolShell dangerous. First, it targeted on-premises SharePoint, which many Canadian organizations still run. Second, exploitation gave attackers the ability to extract machine keys, so simply applying the patch afterward did not always close the door. Third, it moved fast, with opportunistic scanning following disclosure within days. The Canadian Centre for Cyber Security pushed urgent guidance to patch and hunt.
What We Recommended to Clients
- Patch immediately to the fixed builds, then confirm the update actually applied to every farm node.
- Rotate machine keys after patching, because a patch alone does not invalidate keys an attacker already stole.
- Hunt for web shells and suspicious files in SharePoint layouts directories, and review IIS logs for unusual requests.
The Bigger Lesson
ToolShell reinforced a pattern we see constantly: internet-exposed enterprise applications are prime targets, and the window between disclosure and mass exploitation keeps shrinking. For smaller Canadian organizations without a dedicated security team, the practical takeaway is not to run public-facing SharePoint at all unless there is a clear business need. Compromise assessment, not just patching, is the correct response once an item is under active exploitation.
Takeaway
If you run on-premises SharePoint, verify you patched CVE-2025-53770 and its companions, rotate machine keys, and hunt for web shells rather than assuming a clean bill of health. For any internet-facing application, build a workflow that can go from advisory to patched-and-verified in hours, not weeks.