ToolShell exploitation and machine key theft: what teams need to know

TL;DR: Multiple ransomware groups are exploiting ToolShell flaws in Microsoft SharePoint to gain unauthenticated access, steal machine keys, forge authentication tokens, and deploy ransomware, with hundreds of systems compromised globally, according to Anomali Cyber Watch. Patch status alone is no longer a sufficient control when exposed servers can be treated as already breached.

NHIMG editorial — based on content published by Anomali: Anomali Cyber Watch on PXA Stealer, ClickFix malware, fake TikTok shops, ThrottleStop, and more

Questions worth separating out

Q: What breaks when SharePoint machine keys are exposed in a server compromise?

A: When machine keys are exposed, patching the vulnerable code no longer guarantees recovery because the attacker may still be able to forge trusted authentication tokens.

Q: Why do internet-facing application flaws often become identity risks?

A: Because web application compromise frequently exposes the components attackers need to reach identity controls, including configuration files, session tokens, admin interfaces, or service credentials.

Q: What do teams get wrong about patching exposed collaboration servers?

A: Teams often assume patching ends the incident, but exposed collaboration servers may already have leaked signing material or session artifacts.

Practitioner guidance

• Rotate machine keys immediately after suspected exposure Invalidate existing SharePoint trust artifacts, restart dependent services, and verify that token-signing material has been replaced across all affected servers.
• Hunt for forged session artifacts and web shells Review IIS logs, SharePoint request patterns, and authentication anomalies for POSTs to ToolShell-related paths, suspicious referrers, and reused session tokens.
• Isolate exposed SharePoint servers until trust is re-established If patching cannot happen immediately, remove internet exposure, segment the host, and assume the application boundary has already been crossed.

What's in the full analysis

Anomali's full post covers the operational detail this post intentionally leaves for the source:

• Per-threat indicator lists for ToolShell, PXA Stealer, ClickFix, and other campaigns covered in the briefing.
• Attack-specific IoCs that ThreatStream users can load into logs and detections for validation.
• Campaign-by-campaign context on how the attacks spread, persist, and evade detection across environments.
• Source material for cross-checking malicious activity against current observations in your own telemetry.

👉 Read Anomali's Cyber Watch coverage of ToolShell exploitation and related threats →

ToolShell exploitation and machine key theft: what teams need to know?

Explore further

View Full Forum →  |  NHI Foundation Course →