Chinese Threat Actors Exploit ToolShell SharePoint Flaw Weeks After Microsoft's July Patch

Threat actors with ties to China exploited the ToolShell vulnerability in Microsoft SharePoint to breach a Middle Eastern telecoms operator, according to Broadcom's Symantec Threat Hunter Team, weeks after the July 2025 patch. The activity has been linked to three Chinese threat groups—Linen Typhoon (Budworm), Violet Typhoon (Sheathminer), and Storm-2603—whose operations have recently involved Warlock, LockBit, and Babuk ransomware families.

Symantec’s latest findings indicate a much wider range of China-based actors abusing the flaw, including Salt Typhoon (Glowworm), which is said to have deployed tools such as Zingdoor, ShadowPad, and KrustyLoader against the telecom entity and two African government bodies. KrustyLoader is a Rust-based loader previously described by Synacktiv in January 2024 and has been used in attacks involving Ivanti Endpoint Manager Mobile and SAP NetWeaver.

In other incidents, the attackers used initial access exploits followed by SQL servers and Apache HTTP servers running Adobe ColdFusion to deliver payloads via DLL side-loading, with some activity also involving privilege escalation using CVE-2021-36942 (PetitPotam). The findings emphasise credential theft and persistent, stealthy access, and Symantec notes there is overlap with Glowworm activity but stops short of attributing the operation to a single group.