CISOPlatform Breach Intelligence July 22, 2025 – Microsoft SharePoint Zero-Day Exploits, Mass Cryptojacking Campaign, Chrome ANGLE Vulnerability

Key Breach Incidents Overview

1. Critical Microsoft SharePoint Zero-Day Actively Exploited, Breaches 75+ Company Servers - TheHackerNews
2. Microsoft Releases Urgent Patch for SharePoint RCE Flaw Exploited in Ongoing Cyber Attacks - TheHackerNews
3. Microsoft Rushes Emergency Patch for Actively Exploited SharePoint 'ToolShell' Bug - Dark Reading
4. Microsoft SharePoint zero-day breach hits on-prem servers - CSO Magazine
5. Microsoft Fix Targets Attacks on SharePoint Zero-Day - Krebs on Security
6. Microsoft: Attackers Actively Compromising On-Prem SharePoint Customers - Infosecurity Magazine
7. Mass Cryptojacking Campaign Hits Over 3,500 Websites - TheHackerNews
8. Chrome ANGLE/GPU Sandbox Escape Vulnerability Actively Exploited - TheHackerNews

Major Incident Analysis

Microsoft SharePoint Zero-Day Exploitation Campaign (CVE-2025-53770, CVE-2025-53771)

Source: TheHackerNews, Dark Reading, CSO Magazine, Krebs on Security

 

Timeline:
• July 18, 2025 (6:00 PM CET): Active exploitation begins
• July 20, 2025: CISA adds CVE-2025-53770 to Known Exploited Vulnerabilities catalog
• July 21, 2025: Microsoft releases emergency patches for both vulnerabilities

Attack Vector: Sophisticated vulnerability chaining exploiting deserialization flaws in on-premises SharePoint Server. Attackers abuse CVE-2025-49706 (authentication bypass) combined with CVE-2025-49704 (code injection) to achieve unauthenticated remote code execution. The exploit chain, dubbed "ToolShell," involves sending crafted POST requests to /_layouts/15/ToolPane.aspx with spoofed Referer headers.

Threat Actor: Advanced persistent threat group with sophisticated reconnaissance capabilities targeting critical infrastructure, government entities, universities, and energy companies across multiple sectors.

Indicators of Compromise (IOCs):

• spinstall0.aspx - Malicious ASPX payload file
• POST requests to /_layouts/15/ToolPane.aspx
• Spoofed Referer header: _layouts/SignOut.aspx
• PowerShell execution for MachineKey extraction
• Anomalous SharePoint service restarts

CVE References:
• CVE-2025-53770 (CVSS 9.8): Remote code execution via deserialization of untrusted data in SharePoint Server
• CVE-2025-53771 (CVSS 7.1): Spoofing vulnerability enabling path traversal in SharePoint
• CVE-2025-49706 (CVSS 6.3): Authentication bypass vulnerability (chained)
• CVE-2025-49704 (CVSS 8.8): Code injection vulnerability (chained)

MITRE ATT&CK Mapping:
• T1190 (Initial Access): Exploit Public-Facing Application
• T1059.001 (Execution): PowerShell execution for credential harvesting
• T1505.003 (Persistence): Web Shell deployment via ToolShell backdoor
• T1552.004 (Credential Access): Private Keys extraction (ASP.NET MachineKey)
• T1021.001 (Lateral Movement): Remote Services via compromised SharePoint integration

Analysis: This represents a critical supply chain attack targeting enterprise collaboration infrastructure. The sophistication of vulnerability chaining demonstrates advanced threat actor capabilities with deep understanding of SharePoint architecture. The theft of ASP.NET machine keys enables persistent access and lateral movement across integrated Microsoft services (Teams, OneDrive, Outlook). Organizations with internet-facing SharePoint servers should assume compromise and implement immediate containment measures.

Mass Cryptojacking Campaign Targeting 3,500+ Websites

Source: TheHackerNews

 

Timeline:
• July 21, 2025: Security researchers discover widespread JavaScript-based cryptomining campaign
• Ongoing: Dynamic payload delivery via WebSocket connections

Attack Vector: Stealthy JavaScript injection into legitimate websites using obfuscated code and WebSocket protocols. Attackers leverage background Web Workers to dynamically adjust mining threads based on system resources, evading browser-based detection mechanisms.

Threat Actor: Financially motivated cybercriminal group with advanced web application exploitation capabilities and sophisticated evasion techniques.

Indicators of Compromise (IOCs):

• Obfuscated JavaScript miners in website source code
• WebSocket connections to cryptomining pools
• Background Web Worker processes consuming CPU cycles
• Dynamic thread adjustment based on system monitoring

Analysis: This campaign demonstrates evolution in cryptojacking methodologies with advanced evasion capabilities. The use of WebSocket protocols for dynamic payload delivery and resource-aware mining optimization indicates sophisticated threat actor capabilities. Organizations should implement enhanced web application security monitoring and client-side protection mechanisms.

Conclusion and Forward-Looking Insights

The cybersecurity incidents analyzed on July 21, 2025 demonstrate the critical importance of proactive vulnerability management and integrated security architecture for enterprise collaboration platforms. The SharePoint zero-day exploitation campaign highlights the risks of internet-facing collaboration infrastructure and the need for accelerated cloud migration strategies. Future threat evolution will likely focus on supply chain attacks against business-critical platforms, advanced evasion techniques for cryptojacking campaigns, and systematic exploitation of container and browser security boundaries. Organizations must prioritize continuous security validation, rapid patch deployment capabilities, and strategic threat intelligence integration to maintain effective security posture against sophisticated threat actors targeting enterprise infrastructure.

Sources and References

1. TheHackerNews - Critical Microsoft SharePoint Zero-Day
2. TheHackerNews - Microsoft SharePoint Patch Release
3. Dark Reading - SharePoint ToolShell Bug
4. CSO Magazine - SharePoint Zero-Day Analysis
5. Krebs on Security - SharePoint Attack Analysis
6. Infosecurity Magazine - SharePoint Compromise Report
7. CISA Known Exploited Vulnerabilities Catalog
8. Eye Security - ToolShell Analysis
9. Palo Alto Networks Unit 42 - Threat Intelligence