AnalysisPublished 23 Jul 2025

OSINT - Disrupting active exploitation of on-premises SharePoint vulnerabilities

Affects type osintSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

This report discusses open-source intelligence (OSINT) related to disrupting active exploitation of vulnerabilities in on-premises SharePoint deployments. The threat involves multiple advanced persistent threat (APT) groups such as APT31, Emissary Panda, and Storm-2603, leveraging techniques including exploitation of public-facing applications, PowerShell execution, web shells, reflective code loading, and automated data collection. No specific CVE or technical details are provided, and no patch is currently available. The threat is assessed as high severity due to active exploitation and involvement of sophisticated threat actors.

Impact

The exploitation of SharePoint vulnerabilities by sophisticated threat actors can lead to unauthorized remote code execution, persistent access via web shells, and automated data collection from compromised environments. This can result in significant data breaches, espionage, and disruption of business operations. The involvement of multiple APT groups indicates a high risk to organizations running vulnerable on-premises SharePoint instances.

Defensive guidance

Organizations should monitor vendor advisories for updates and consider implementing compensating controls such as network segmentation and enhanced monitoring of SharePoint environments.

Summary

The intelligence highlights ongoing exploitation activities targeting on-premises SharePoint vulnerabilities by known APT groups including APT31, Emissary Panda, and Storm-2603. Attack techniques identified include exploitation of public-facing applications (MITRE ATT&CK T1190), PowerShell command execution (T1059.001), deployment of web shells (T1505.003), reflective code loading (T1620), and automated collection of data (T1119). The report does not specify particular vulnerabilities or affected SharePoint versions, nor does it provide technical details or indicators of compromise.

Indicators of compromise

URLs 1

Ngrok tunnel delivering PowerShell to C2

c34718cbb4c6.ngrok-free.app/file.ps1

IP addresses 4

134.199.202.205IP address exploiting SharePoint vulnerabilities
104.238.159.149IP address exploiting SharePoint vulnerabilities
188.130.206.168IP address exploiting SharePoint vulnerabilities
131.226.2.6Post exploitation C2

Hashes 1

Hash of spinstall0.aspx

92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514

Vulnerability 9

CVE-2025-53770
CVE-2025-49704
CVE-2025-53771
CVE-2025-49706
CVE-2025-49706
CVE-2025-53771
CVE-2025-49704
CVE-2025-49704
CVE-2025-53770

Link 10

https://vulnerability.circl.lu/vuln/CVE-2025-49706
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706
https://vulnerability.circl.lu/vuln/CVE-2025-53771
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771
https://vulnerability.circl.lu/vuln/CVE-2025-49704
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704
https://vulnerability.circl.lu/vuln/CVE-2025-49704
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704
https://vulnerability.circl.lu/vuln/CVE-2025-53770
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770

Datetime 10

2025-07-08T16:58:07.343000+00:00
2025-07-23T03:55:22.461000+00:00
2025-07-20T22:16:52.203000+00:00
2025-07-22T21:03:27.322000+00:00
2025-07-08T16:58:05.908000+00:00
2025-07-22T21:04:05.006000+00:00
2025-07-08T16:58:05.908000+00:00
2025-07-22T21:04:05.006000+00:00
2025-07-20T01:06:33.607000+00:00
2025-07-23T03:55:21.046000+00:00

Text 23

PUBLISHED
PUBLISHED
PUBLISHED
PUBLISHED
PUBLISHED
\1[5-6]\TEMPLATE\LAYOUTS\debug_dev.js
Malicious
Sentinel Advanced Security Information Model
//IP list and domain list- _Im_NetworkSession let lookback = 30d; let ioc_ip_addr = dynamic(["131.226.2.6", "134.199.202.205", "104.238.159.149", "188.130.206.168"]); let ioc_domains = dynamic(["c34718cbb4c6.ngrok-free.app"]); _Im_NetworkSession(starttime=todatetime(ago(lookback)), endtime=now()) | where DstIpAddr in (ioc_ip_addr) or DstDomain has_any (ioc_domains) | summarize imNWS_mintime=min(TimeGenerated), imNWS_maxtime=max(TimeGenerated), EventCount=count() by SrcIpAddr, DstIpAddr, DstDomain, Dvc, EventProduct, EventVendor
Sentinel Advanced Security Information Model

File 2

debug_dev.jsFile containing web config data, including MachineKey data
Spinstall0.aspxWeb shell used by threat actors Actors have also modified the file name in a variety of ways, such as spinstall.aspx, spinstall1.aspx, spinstall2.aspx

Community reviews

Loading reviews…