TOOLSHELL USED TO COMPROMISE TELECOMS COMPANY IN MIDDLE EAST

Summary from the TLDR InfoSec newsletter

Chinese threat actors exploited the ToolShell SharePoint vulnerability (CVE-2025-53770) just two days after Microsoft patched it in July, compromising a Middle East telecoms company and multiple government agencies by using the Zingdoor backdoor, the ShadowPad Trojan, and KrustyLoader malware. The attackers demonstrated rapid exploitation capabilities by mass-scanning for vulnerable systems, then deploying sophisticated toolsets, including DLL sideloading techniques, credential-dumping utilities, and the Sliver C2 framework for persistent access. Organizations should prioritize immediate patching of SharePoint servers and monitor for indicators, including the provided file hashes, with particular focus on DLL sideloading activities and connections to the identified AWS-hosted C2 infrastructure.