Your SharePoint server just became a gateway for ransomware operators. Between July 7-18, attackers used four zero-day vulnerabilities to compromise over 400 organizations worldwide, including the National Institute of Health (NIH) and National Nuclear Security Administration (NNSA).
The immediate response is straightforward: patch, hunt for compromise, reset credentials. But if you stop there, you’re missing the bigger lesson.
ToolShell isn’t really about SharePoint vulnerabilities. It’s about what happens when legacy infrastructure meets today’s threat landscape.
Why This Hits Different
Most zero-days affect a handful of organizations before patches contain the damage. ToolShell compromised 400+ organizations across continents because it exploited a fundamental gap in how we think about infrastructure security.
The targeted organizations share common characteristics:
- Running SharePoint 2016, 2019, or Subscription Edition
- Manual patching processes that create windows of exposure
- Internet-facing servers with minimal segmentation
- Limited visibility into application-layer activity
These aren’t security failures. They’re operational realities for organizations running business-critical systems that can’t be patched on Microsoft’s timeline.
The attackers understood this. Storm-2603 and other State-linked groups spent time mapping these environments before pivoting to ransomware deployment. They knew exactly how long they had between disclosure and patching.
What We’re Seeing in Response Efforts
I’ve worked with several organizations responding to ToolShell compromise. The patterns are consistent and revealing.
The Detection Problem: Most organizations discovered compromise through external notification, not internal monitoring. Their SIEM collected SharePoint logs but wasn’t tuned to detect the specific attack patterns ToolShell used.
The Response Delay: Emergency patching sounds fast, but it’s not. Organizations need time to test patches against critical business processes. During that window, attackers maintained access and expanded their foothold.
The Scope Surprise: What looked like SharePoint compromise turned into domain-wide credential theft. Organizations underestimated how SharePoint service accounts could be leveraged for lateral movement.
The Recovery Reality: Even after patching and credential resets, some organizations are still finding evidence of persistent access. The attackers were thorough.
Beyond the Immediate Response
If you’re dealing with ToolShell compromise, the immediate steps are clear:
- Apply the necessary security updates released by Microsoft.
- Configure Antimalware Scan Interface (AMSI) in SharePoint as indicated by Microsoft and deploy Microsoft Defender AV on all SharePoint servers.
- Rotate ASP.NET machine keys, then after applying Microsoft’s security update, rotate ASP.NET machine keys again, and restart the IIS web server.
- Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) from the internet. For example, SharePoint Server 2013 and earlier versions are end-of-life and should be discontinued if still in use.
- Monitor suspicious requests to the sign-out page: /_layouts/SignOut.aspx is the exact HTTP header used by threat actors to exploit ToolPane.aspx for initial access
- Monitor for POSTs to /_layouts/15/ToolPane.aspx?DisplayMode=Edit
- Conduct scanning for IPs 107.191.58[.]76, 104.238.159[.]149, and 96.9.125[.]147, particularly between July 18-19, 2025.
But the real question is what happens next.
Legacy Infrastructure Isn’t Going Away: You can’t migrate everything to the cloud tomorrow. Budget cycles, compliance requirements, and operational dependencies mean on-premise SharePoint will be around for years.
Patching Windows Are Real: Critical business systems can’t be patched the day Microsoft releases fixes. Testing requirements and change management processes create necessary delays that attackers exploit.
Application Security Is Different: Network security controls don’t see application-layer attacks. You need visibility into what’s happening inside SharePoint, not just network traffic to and from SharePoint servers.
What Actually Works
The organizations handling this best share specific approaches:
They treat application servers like endpoints. SharePoint servers get EDR coverage, behavioral monitoring, and regular threat hunting attention. They’re not just infrastructure.
They segment based on data sensitivity, not just network topology. SharePoint servers containing sensitive data get additional isolation and monitoring, regardless of where they sit on the network.
They plan for compromise. Incident response procedures include application-specific steps for SharePoint, including how to preserve forensic evidence while maintaining business operations.
They have migration timelines. Even if cloud migration takes years, they have concrete plans for reducing on-premise exposure over time.
The Bigger Picture
ToolShell represents something we’re going to see more of: sophisticated attackers targeting the operational realities of enterprise IT rather than just technical vulnerabilities.
They understand patch cycles. They know which systems can’t be quickly updated. They plan attacks around the gap between vulnerability disclosure and organizational response.
This changes how we need to think about defense. It’s not enough to have good patch management. You need controls that work during the window between disclosure and deployment.
Getting Help Where It Matters
If you’re responding to ToolShell compromise, you don’t have to figure this out alone. We’re working with organizations across sectors to not just respond to the immediate threat but build capabilities that prevent the next one.
Threat hunting to find compromise that standard tools miss, including specific ToolShell indicators and broader signs of persistent access.
Detection engineering to tune monitoring for application-layer attacks that network controls don’t catch.
Migration planning to reduce on-premise exposure over realistic timelines that account for business requirements.
Operational security to build response capabilities around the systems you can’t quickly replace.
The organizations that turn ToolShell from crisis into capability improvement are the ones that use it as a catalyst for broader security transformation.
What gaps is ToolShell exposing in your environment? The response you build now determines how well you handle the next campaign that targets legacy infrastructure.
If you need specific guidance on ToolShell response or want to discuss building more resilient application security, reach out directly. We’re seeing the same patterns across responses and can help you avoid the common mistakes.
Don’t miss another article. Subscribe to our blog now.
{% module_block module “widget_4d478aa0-3bf0-4250-8e4f-c96fabddf96d” %}{% module_attribute “button_text” is_json=”true” %}{% raw %}”Subscribe now”{% endraw %}{% end_module_attribute %}{% module_attribute “child_css” is_json=”true” %}{% raw %}{}{% endraw %}{% end_module_attribute %}{% module_attribute “css” is_json=”true” %}{% raw %}{}{% endraw %}{% end_module_attribute %}{% module_attribute “definition_id” is_json=”true” %}{% raw %}null{% endraw %}{% end_module_attribute %}{% module_attribute “field_types” is_json=”true” %}{% raw %}{“button_text”:”text”,”link”:”link”,”style”:”group”}{% endraw %}{% end_module_attribute %}{% module_attribute “label” is_json=”true” %}{% raw %}null{% endraw %}{% end_module_attribute %}{% module_attribute “link” is_json=”true” %}{% raw %}{“no_follow”:false,”open_in_new_tab”:false,”rel”:””,”sponsored”:false,”url”:{“content_id”:164756427656,”href”:”javascript:postMessage({type:’HS_DISPLAY_CALL_TO_ACTION’,id:164756427656});”,”href_with_scheme”:null,”type”:”CALL_TO_ACTION”},”user_generated_content”:false}{% endraw %}{% end_module_attribute %}{% module_attribute “module_id” is_json=”true” %}{% raw %}8243667{% endraw %}{% end_module_attribute %}{% module_attribute “path” is_json=”true” %}{% raw %}”@hubspot/button”{% endraw %}{% end_module_attribute %}{% module_attribute “schema_version” is_json=”true” %}{% raw %}2{% endraw %}{% end_module_attribute %}{% module_attribute “smart_objects” is_json=”true” %}{% raw %}[]{% endraw %}{% end_module_attribute %}{% module_attribute “smart_type” is_json=”true” %}{% raw %}”NOT_SMART”{% endraw %}{% end_module_attribute %}{% module_attribute “tag” is_json=”true” %}{% raw %}”module”{% endraw %}{% end_module_attribute %}{% module_attribute “type” is_json=”true” %}{% raw %}”module”{% endraw %}{% end_module_attribute %}{% module_attribute “wrap_field_tag” is_json=”true” %}{% raw %}”div”{% endraw %}{% end_module_attribute %}{% end_module_block %}
