The ToolShell exploit, affecting on-premises Microsoft SharePoint servers, has driven a rise in threat actors exploiting public-facing applications for initial access. In the last quarter, this tactic appeared in over 60% Cisco Talos Incident Response (Talos IR) engagements, an increase from 10% in the previous quarter. Almost 40% of all engagements involved ToolShell activity, majorly contributing to this tactic’s rise in popularity, Cisco Talos explained in a recent report. The ToolShell exploit chain was first made public in mid-July 2025. The attack sees CVE-2025-53770 and CVE-2025-53771, two critical and high-severity vulnerabilities in internet-facing SharePoint servers, exploited. In July 2025, Microsoft warned that Chinese-based threat groups, Linen Typhoon and Violet Typhoon,…