China-linked hackers exploit patched ToolShell flaw to breach Middle East telecom

China-based threat actors exploited the ToolShell SharePoint flaw CVE-2025-53770 soon after Microsoft patched it in July 2025 to breach a Middle East telecoms organisation, according to Broadcom’s Symantec Threat Hunter Team. The attackers, linked to Glowworm (aka Earth Estries) and UNC5221, breached multiple targets including two African government departments, two South American agencies, and a U.S. university, using tools such as Zingdoor and KrustyLoader and targeting SQL and Apache ColdFusion servers.

A fake “mantec.exe” masquerading as Symantec software was sideloaded to deploy malware, with KrustyLoader dropped on 25 July to fetch second-stage payloads and evade analysis. The operation also involved the use of a webshell and various living-off-the-land utilities, including Certutil for file downloads, GoGo Scanner for network scanning, Revsocks for proxying traffic, and Procdump, Minidump and LsassDumper to extract credentials.

Microsoft later confirmed that three China-based groups—Budworm, Violet Typhoon (Sheathminer), and Storm-2603—had exploited ToolShell, with Storm-2603 deploying Warlock ransomware, and the overall campaign remains attribution uncertain but China-based.