Hackers Exploit SharePoint Zero-Day Vulnerability Since July 7 to Hijack Credentials and Ensure Ongoing Access
July 22, 2025
Vulnerability / Threat Intelligence
A critical vulnerability in Microsoft SharePoint has come to light, and reports indicate that it has been under active exploitation since July 7, 2025. Findings from Check Point Research reveal that the initial exploitation attempts were aimed at a significant government entity in the Western hemisphere. The malicious activities appeared to escalate notably on July 18 and 19, affecting various sectors, including government, telecommunications, and software industries across North America and Western Europe.
Check Point’s investigation has traced the exploit activity back to three specific IP addresses: 104.238.159[.]149, 107.191.58[.]76, and 96.9.125[.]147. Notably, one of these addresses has previously been linked to the exploitation of vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), specifically referencing CVE-2025-4427 and CVE-2025-4428. The attack poses a severe threat to thousands of organizations globally, as emphasized by Lotem Finkelstein, Director of Threat Intelligence at Check Point.
The implications of this zero-day vulnerability extend far beyond immediate exploitation. Attackers have demonstrated a clear intent to acquire credentials and maintain persistent access to systems, a strategy consistent with various tactics identified in the MITRE ATT&CK Matrix. Techniques such as initial access and persistence have likely been employed, enabling adversaries to infiltrate and remain undetected within targeted environments.
Initial access may have been achieved through phishing or credential dumping methods, commonly used tactics that allow attackers to penetrate defenses. Once inside, the focus likely shifted to establishing persistence, ensuring that the attackers could maintain control over compromised systems even if initial access points were closed. This could involve creating backdoors or leveraging legitimate administrative tools to obscure their activities.
The exploitation of this vulnerability serves as a stark reminder of the continuous cybersecurity challenges facing organizations worldwide. As the threat landscape evolves, business owners must remain vigilant, implementing robust cybersecurity measures to safeguard sensitive data and critical infrastructure against such high-stakes attacks.
In summary, organizations are urged to assess their SharePoint deployments urgently and apply necessary security patches or mitigations. Understanding the tactics and techniques outlined in the MITRE ATT&CK framework can enhance preparedness and response capabilities in the face of dynamic cyber threats. As the situation develops, continued vigilance and proactive measures will be essential in defending against these persistent threats.
