What is ToolShell and why is it in the spotlight now?
ToolShell is a malicious exploit tool targeting Microsoft SharePoint servers. It recently resurfaced as a high-severity cybersecurity threat after Kaspersky’s Global Research and Analysis Team (GReAT) found it linked to a vulnerability that dates back to 2020.

Where did this vulnerability originate?
The ToolShell exploit stems from CVE-2020-1147, a flaw that was supposedly fixed five years ago. Kaspersky researchers say the original fix was incomplete, leaving an exploitable gap that attackers are now abusing.

How widespread are these attacks?
Kaspersky reports exploitation attempts in countries such as Egypt, Jordan, Russia, Vietnam and Zambia. Targets include organizations in government, finance, manufacturing, forestry and agriculture sectors.

What’s new in the 2025 patches?
In July 2025, Microsoft patched CVE-2025-49704 and CVE-2025-49706. However, attackers quickly found a way to bypass these by simply adding a forward slash to the exploit. This led Microsoft to release more comprehensive patches under CVE-2025-53770 and CVE-2025-53771.

Did the vulnerability get fixed properly this time?
Yes. The new patch, CVE-2025-53770, is now considered the true fix for the underlying issue that CVE-2020-1147 tried to resolve. But Kaspersky warns that attackers will likely keep exploiting this chain for years to come.

Why is this significant for cybersecurity?
According to Kaspersky’s principal security researcher Boris Larin, even long-patched vulnerabilities like ProxyLogon, PrintNightmare and EternalBlue remain active threats. ToolShell may follow a similar path due to its ease of exploitation and expected inclusion in popular penetration testing tools.

How should organizations protect themselves?
Kaspersky urges all Microsoft SharePoint users to immediately install the latest security patches. Delays could leave systems open to compromise, especially with threat actors actively targeting unpatched environments.

What other protections are recommended?
Organizations should deploy security solutions with zero-day exploit protection. Kaspersky’s own “Next” platform includes Behavior Detection capabilities that can stop such attacks even before patches are released.

Who discovered this?
Kaspersky’s Global Research and Analysis Team (GReAT), a global group of over 35 elite cybersecurity experts, uncovered the connection between the current exploit and the 2020 flaw. The team is known for discovering threats like Stuxnet and other major APT campaigns.

Is this threat likely to fade anytime soon?
Not likely. Kaspersky researchers anticipate that public exploit code for ToolShell will be widely distributed in hacking tools, leading to ongoing exploitation in the years ahead.

Bottom line:
ToolShell is a textbook case of how incomplete patching can resurface as a new threat. Organizations should act fast, patch fully, and reinforce defenses before attackers exploit the next opening.