Record · corpus.blog/posts/01a07df3-579a-71d1-bdfb-c051c2423e56

Threat hunting case study: ToolShell

Intel 471 · published 23 September 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at intel471.com Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 23
Words captured: 1,397

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://nvd.nist.gov/vuln/detail/CVE-2025-49704

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2025-49706

nvd.nist.gov

https://blog.viettelcybersecurity.com/sharepoint-toolshell/

blog.viettelcybersecurity.com

https://www.microsoft.com/en-us/msrc/mapp

microsoft.com

https://nvd.nist.gov/vuln/detail/CVE-2025-53770

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2025-53771

nvd.nist.gov

https://www.washingtonpost.com/technology/2025/07/20/microsoft-sharepoint-hack/

washingtonpost.com

https://research.eye.security/sharepoint-under-siege/?_gl=1*lv4k4m*_ga*MTE1MDA1NTA2MC4xNzU2ODY3NDYy*_ga_7Z41NDWDPT*czE3NTgwNzU2ODkkbzEkZzEkdDE3NTgwNzU3MTkkajM0JGwwJGgw*_gcl_au*NDM3OTI5MDE3LjE3NTgwNzU2OTM

research.eye.security

https://www.divd.nl/

divd.nl

https://www.linkedin.com/posts/eyesecurity_sharepoint-under-siege-toolshell-mass-exploitation-activity-7352771611671814144-2SeV

linkedin.com

https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities

microsoft.com

https://attack.mitre.org/groups/G0128/

attack.mitre.org

https://www.intel471.com/platform/cyber-threat-hunting

intel471.com

https://www.intel471.com/lp/hunter-community-edition-access

intel471.com

https://learn.microsoft.com/en-us/iis-administration/api/worker-processes

learn.microsoft.com

Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors Read at the source ↗

unit42.paloaltonetworks.com

https://malpedia.caad.fkie.fraunhofer.de/actor/pink_sandstorm

malpedia.caad.fkie.fraunhofer.de

https://www.paloaltonetworks.com/blog/security-operations/through-the-cortex-xdr-lens-uncovering-a-new-activity-group-targeting-governments-in-the-middle-east-and-africa/

paloaltonetworks.com

https://research.eye.security/sharepoint-under-siege/

research.eye.security

https://www.youtube.com/watch?v=XUuY3kW9JRc

youtube.com

https://www.intel471.com/platform/malware-intelligence

intel471.com

https://www.intel471.com/platform/adversary-intelligence

intel471.com

https://www.intel471.com/company/contact

intel471.com