At TecnetOne, we want to keep you informed about the latest threats that could endanger your business continuity. Today we report on a new wave of attacks targeting Microsoft SharePoint vulnerabilities, already affecting more than 148 organizations worldwide.
The most concerning aspect is that ransomware groups have joined this campaign, raising the danger level even higher for businesses and public institutions. Among the most notable threats is the 4L4MD4R ransomware, a variant discovered just days ago and already wreaking havoc.
Below, we’ll explain in detail how this threat works, which organizations have already been victimized, and most importantly, what you can do to protect yourself.
In recent weeks, researchers at Palo Alto Networks Unit 42 identified an exploit chain in SharePoint called ToolShell. Various malicious actors have leveraged it to compromise servers and, in many cases, deploy ransomware.
Alarmingly, this is no ordinary campaign. According to Microsoft and Google, China-backed hacking groups are behind the attacks, including Linen Typhoon, Violet Typhoon, and Storm-2603.
The impact is already global:
In other words: No one is safe without swift action.
On July 27, researchers detected a malware loader that downloaded and executed the 4L4MD4R ransomware from a compromised server.
Its functionality is both sophisticated and dangerous:
It also attempts to disable security monitoring on the device, making it even more dangerous as it can remain undetected longer.
Related reading: New Zero-Day in SharePoint (CVE-2025-53770): Update Now!
The ToolShell attacks exploited two critical vulnerabilities:
These were used as zero-days, meaning they were unknown to developers at the time of the attack, allowing cybercriminals to infiltrate supposedly up-to-date systems.
Microsoft later released patches during its July 2025 Patch Tuesday, assigning new identifiers:
However, the update came too late for many organizations already compromised. According to Dutch firm Eye Security, at least 400 servers were infected, impacting more than 148 companies.
4L4MD4R decryption instructions (Source: BLEEPINGCOMPUTER)
Initially, estimates suggested about 54 organizations had been affected. However, new investigations reveal the scope is much larger.
Eye Security confirmed attackers had persistent access to many victims’ networks, meaning they could not only deploy ransomware but also exfiltrate sensitive data.
The U.S. CISA (Cybersecurity and Infrastructure Security Agency) classified one of the exploited vulnerabilities as high risk, ordering federal agencies to secure systems within 24 hours.
This paints a clear picture: this isn’t opportunistic — it’s a well-funded, organized campaign with strategic targets.
While it may seem these attacks only affect large institutions, the reality is that any organization using Microsoft SharePoint is at risk — especially if systems are not updated or lack additional security layers.
The consequences can be devastating:
In short: this is not a hypothetical threat — it’s already hitting hundreds of organizations like yours.
At TecnetOne, we recommend taking immediate action with the following measures:
Ensure your SharePoint servers are updated with the July 2025 patches.
Solutions like Sophos Intercept X use AI and behavior detection to stop even unknown threats.
Deploy monitoring systems that can detect unusual activity and exploitation attempts.
Apply the principle of least privilege: each user should have only the access they need.
Having a clear protocol reduces the impact of attacks and speeds up recovery.
Ensure backups are offline or isolated from your main network to prevent them from being encrypted by ransomware.
Related reading: Microsoft Links SharePoint Attacks to Chinese Hacker Groups
The SharePoint server attacks are a reminder that cybersecurity cannot be left to chance. Today more than ever, you need reliable, up-to-date solutions backed by experts.
At TecnetOne, we’re here to help you implement best practices and robust solutions, including Sophos Endpoint and Intercept X, to strengthen your infrastructure and shield your organization from threats like 4L4MD4R.
The key is not waiting to become a victim. The sooner you act, the better protected your business will be against increasingly sophisticated and destructive campaigns.