Topic starter
12/06/2026 12:26 am
TL;DR: The ToolShell campaign linked to SharePoint CVE-2025-53770 shows how an RCE on exposed servers can become internal compromise through web shells, forged tokens, and privilege escalation into Microsoft services, according to Riptides. Perimeter controls are no longer enough when attackers pivot through authenticated sessions and process-level trust.
Editorial analysis by NHI Mgmt Group, based on content published by Riptides: “SharePoint Under Siege: Lateral Movement Is Still Security’s Blind Spot”.
Key questions
Q: What breaks when SharePoint is compromised but downstream services still trust its sessions?
A: The control that breaks is the assumption that authenticated internal traffic is inherently safe.
Q: Why does lateral movement remain such a serious risk after initial access is contained?
A: Because containment at the perimeter does not stop a hijacked identity from moving inside the environment.
Q: What are the signs that internal service trust is too broad?
A: Common signs include service accounts with admin-like access, internal APIs that accept calls from many unrelated workloads, and little visibility into east-west traffic.
Practitioner guidance
- Map internal trust paths from SharePoint to downstream services Identify which services accept SharePoint-derived authentication material, then reduce implicit trust between the originating application and adjacent Microsoft services.
- Review machine key handling and recovery procedures Inventory where ASP.NET machine keys are stored, who can access them, and how quickly they can be rotated after compromise.
- Correlate token issuance with privileged service access Join authentication logs, token creation events, and privileged access records so forged or replayed sessions are easier to spot when lateral movement begins.
Bottom line: SharePoint exploitation in this campaign mattered because it converted a server-side weakness into trusted internal movement.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/06/2026 9:41 am
Process-level trust is now the real perimeter: The article shows that network boundaries no longer describe where compromise is contained. Once a hijacked process can mint or reuse authentication material, downstream services accept movement as legitimate. The implication is that identity governance has to extend to runtime behaviour, not stop at host or subnet controls.
A few things that frame the scale:
- 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.
A question worth separating out:
Q: Should teams treat machine keys and forged tokens as incident-response priorities?
A: Yes. Once machine keys or similar signing material may be exposed, teams should assume authentication trust has been weakened and investigate how far the blast radius extends. The key question is which sessions, services, and administrative paths were reachable before trust was revoked.
👉 Read our full editorial: SharePoint lateral movement exposes the limits of perimeter controls