On July 7, 2025, cybersecurity researchers from Check Point and Microsoft’s threat intelligence teams observed the first active exploitation attempts targeting critical SharePoint Server vulnerabilities CVE-2025-53770 and CVE-2025-53771. These zero-day flaws, affecting SharePoint Server 2016, 2019, and Subscription Edition, represent a severe threat to any organization running on-premises collaboration infrastructure — including cryptocurrency exchanges, custodians, and blockchain development firms that rely on Microsoft’s enterprise stack.
The Threat Landscape
The attack chain begins with exploitation of CVE-2025-49706, a spoofing vulnerability, combined with CVE-2025-49704, a remote code execution flaw targeting internet-facing SharePoint servers. Threat actors initiate reconnaissance through POST requests to the ToolPane endpoint, followed by deployment of malicious web shells named spinstall0.aspx and variants.
Microsoft has attributed the exploitation to three threat groups: Linen Typhoon and Violet Typhoon — both established Chinese state-sponsored actors — and Storm-2603, which has escalated its operations to include ransomware deployment. The web shells steal ASP.NET MachineKey data, enabling attackers to hijack session management and authentication mechanisms.
For cryptocurrency organizations running on-premises SharePoint deployments, this is not an abstract threat. Exchange operators often use SharePoint for internal document management, compliance workflows, and regulatory reporting. A compromised SharePoint server could provide attackers with a foothold into production networks, customer data stores, and even signing key infrastructure.
Core Principles
The fundamental defense against zero-day exploitation rests on three pillars: reduction of attack surface, defense-in-depth monitoring, and rapid patching capability. Internet-facing SharePoint servers should never be directly accessible without a web application firewall and reverse proxy layer. Network segmentation must ensure that collaboration infrastructure cannot reach production cryptocurrency systems.
Monitoring should focus on detecting anomalous POST requests to ToolPane endpoints, unexpected ASP.NET assembly loading, and modifications to IIS configurations. The known indicators of compromise include web shell files matching the pattern spinstall*.aspx and outbound connections to command-and-control infrastructure at update.updatemicfosoft.com and IP addresses 65.38.121.198 and 131.226.2.6.
Cryptocurrency firms should also verify that their Microsoft Defender configurations are properly enforced. The observed attacks include attempts to disable Defender protections through direct registry modifications via the w3wp.exe process — a technique that succeeds only when endpoint detection and response tools are misconfigured or absent.
Tooling and Setup
Microsoft has released security updates addressing these vulnerabilities. The recommended remediation sequence is: apply all SharePoint security updates, enable Antimalware Scan Interface in Full Mode, rotate ASP.NET machine keys across all SharePoint servers, and execute iisreset.exe to apply changes. Organizations should also scan for the known web shell hash SHA-256: 92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514.
For crypto infrastructure teams, additional hardening steps include deploying network intrusion detection rules for the known IOCs, implementing strict egress filtering to block command-and-control communications, and establishing forensic baselines for normal SharePoint server behavior. Consider deploying honeypot SharePoint instances to detect reconnaissance activity before it reaches production systems.
Ongoing Vigilance
The SharePoint zero-day situation is evolving rapidly. Storm-2603 has demonstrated the capability to escalate from initial access to full ransomware deployment within hours, using Mimikatz for credential harvesting, PsExec and Impacket for lateral movement, and Group Policy Object manipulation for mass ransomware distribution via Warlock ransomware. The speed of this kill chain means that delayed detection equals guaranteed damage.
Bitcoin trades at $108,299 and Ethereum at $2,543 as this zero-day landscape unfolds. The intersection of high-value cryptocurrency assets and enterprise collaboration vulnerabilities creates a target-rich environment for sophisticated threat actors. Organizations that fail to patch promptly will find themselves in the crosshairs of groups that have already demonstrated both capability and intent.
Final Takeaway
The CVE-2025-53770 exploitation wave is a wake-up call for any cryptocurrency organization running on-premises Microsoft infrastructure. The patches exist — apply them now. Rotate your machine keys, enable AMSI, and verify that your monitoring can detect the known web shell patterns. In the current threat landscape, a SharePoint server is not just a collaboration tool — it is a potential gateway to your entire infrastructure.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making any financial decisions.
spinstall0.aspx is such a generic filename for a web shell. the fact that it worked on multiple targets means nobody is monitoring their IIS logs. basic file integrity checking would catch this immediately
spinstall0.aspx is such a generic filename for a web shell. the fact that it worked on multiple targets means nobody is monitoring their IIS logs. basic file integrity checking would catch this immediately
three threat groups exploiting the same SharePoint zero-day simultaneously means the patch gap was known in the wild for weeks before Microsoft disclosed. crypto exchanges running on-prem SharePoint are sitting ducks
three threat groups exploiting the same SharePoint zero-day simultaneously means the patch gap was known in the wild for weeks before Microsoft disclosed. crypto exchanges running on-prem SharePoint are sitting ducks
Bug bounties are the most cost-effective security investment
bug bounties help but they dont catch zero-days. the copy fail vuln was in the kernel since 2017. you cant bounty what nobody knows exists
cisa_clock_ the kernel bug from 2017 sitting unnoticed for 8 years says everything about bug bounty programs. some stuff only nation states find
cisa_clock_ the kernel bug sitting there since 2017 is the real story. 8 years of nation-state access before anyone noticed. bug bounties dont catch what intelligence agencies hide
patchfatigue_ 8 years in the kernel and bug bounties still wouldnt have caught it. nation state budgets dont play by bounty rules
Multi-sig wallets should be the default for everyone in crypto
The cost of a security breach always exceeds the cost of prevention
Formal verification should be mandatory for high-value protocols
Social engineering attacks are becoming more sophisticated
sharepoint zero-days hitting crypto exchanges is the supply chain threat nobody talks about. most exchanges run on-prem microsoft stack for internal ops
Chen Wei exchanges running internal ops on sharepoint is wild. CVE-2025-53770 with state actors deploying web shells and nobody patched for weeks
exchanges running internal ops on unpatched SharePoint in 2025 is genuinely terrifying. CVE-2025-53770 was known for weeks and teams still hadnt patched
sysadmin_crypto weeks without patching while CVE-2025-53770 was public. Linen Typhoon and Violet Typhoon probably had a field day with unpatched instances
Linnea J. on-prem sharepoint in 2025 is basically leaving your front door open with a sign that says please rob me
Chen Wei exactly. if your exchange runs on-prem sharepoint for internal ops in 2025, you deserve what you get. move to cloud or get rekt
Chen Wei exchanges running internal ops on sharepoint is the real CVE here. zero reason a crypto company should have internet facing sharepoint in 2025
Chen Wei nailed it. exchanges spending millions on smart contract audits while their internal network runs unpatched microsoft servers
Linnea J. the scary part is Linen Typhoon and Violet Typhoon arent even the most advanced APTs out there. if they found it, others probably did too and stayed quiet
Linnea J. internet facing SharePoint at a crypto company in 2025 is genuinely indefensible. move to SharePoint Online or just use Notion
8 years undetected in the SharePoint kernel. the bug bounty community needs to accept that some vulns are only found by nation states
web shells named spinstall0.aspx deploying on unpatched servers for weeks. nation state actors dont need zero days when your patch management is this bad
Catalin M. 8 years in the kernel before anyone noticed. bug bounties are reactive by definition, they cant compete with state funded research