Week of July 14, 2025: SharePoint ToolShell Exploits and NoName057(16) Takedown

Security leaders tracked an active Microsoft SharePoint exploit chain nicknamed ToolShell, a newly weaponized FortiWeb SQL-injection flaw, and a persistent SonicWall backdoor disclosed between July 14 and July 20, 2025, while CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog and issued fresh ICS advisories. The same week, Europol's Operation Eastwood dismantled infrastructure tied to the pro-Russian hacktivist group NoName057(16), and Google shipped its fifth 2025 Chrome zero-day patch.

CISA adds SharePoint 'ToolShell' flaw to Known Exploited Vulnerabilities Catalog

CISA added CVE-2025-53770, a Microsoft SharePoint Server remote code execution flaw publicly tracked as ToolShell, to its Known Exploited Vulnerabilities Catalog on July 20, 2025, citing active exploitation. The addition followed Microsoft's guidance on exploitation of on-premises SharePoint servers and came amid reports of webshells and ransomware deployment against vulnerable instances. CISA pointed federal agencies to Binding Operational Directive 22-01 remediation timelines and urged all organizations to prioritize patching this entry as part of ongoing vulnerability management practice. (CISA)

FortiWeb SQL injection flaw exploited, added to CISA's KEV catalog

Fortinet's FortiWeb web application firewall carried a critical SQL injection flaw, CVE-2025-25257, that public proof-of-concept exploits made easy to weaponize for unauthenticated remote code execution with root privileges. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on July 18, 2025, after the Shadowserver Foundation reported exploitation activity dating back to July 11, and by July 16 flagged 77 FortiWeb instances compromised with webshells. Fortinet had already shipped patches, crediting an external researcher with the original report. (Help Net Security)

Persistent OVERSTEP backdoor found on end-of-life SonicWall SMA appliances

Google's Threat Intelligence Group disclosed that a group it tracks as UNC6148 deployed a persistent backdoor called OVERSTEP against fully patched, end-of-life SonicWall Secure Mobile Access 100 series appliances, using stolen administrator credentials and possibly an undisclosed remote-code-execution flaw. The malware hijacked API functions, opened reverse shells, exfiltrated passwords, and hid its presence with rootkit capabilities. SonicWall responded by moving up the SMA 100 series' end-of-support date from October 1, 2027, to December 31, 2025, and urged customers to migrate to newer Zero Trust products. (Help Net Security)

Google patches fifth Chrome zero-day of 2025 under active attack

Google patched its fifth actively exploited Chrome zero-day of 2025, CVE-2025-6558, a high-severity flaw in the ANGLE graphics layer and GPU process that attackers were using to escape Chrome's sandbox. The bug, reported by Google's Threat Analysis Group on June 23, 2025, required victims to visit a specially crafted HTML page. Fixed versions began rolling out July 16, 2025 for Windows, macOS, and Linux, alongside two additional vulnerabilities in the V8 engine and WebRTC feature, with Microsoft confirming it was preparing a matching fix for Edge. (Help Net Security)

Europol's Operation Eastwood dismantles NoName057(16) infrastructure

Europol and Eurojust coordinated Operation Eastwood, a crackdown against the pro-Russian hacktivist group NoName057(16) conducted between July 14 and July 17, 2025, involving authorities from twelve countries plus support from several more and the United States. The action disrupted more than 100 servers tied to the group's DDoS infrastructure, resulted in two arrests, seven arrest warrants including six against Russian nationals, twenty-four house searches, and outreach to over 1,000 supporters warning of potential legal liability. The group had previously targeted Ukraine and NATO-aligned nations. (Help Net Security)

Gigabyte UEFI firmware flaws expose motherboards to bootkits

Carnegie Mellon's CERT/CC disclosed on July 15, 2025 that UEFI firmware on more than 100 Gigabyte motherboard models contained four memory-corruption vulnerabilities, tracked as CVE-2025-7026 through CVE-2025-7029, in the System Management Mode module. The flaws could let attackers write arbitrary content to protected SMRAM and plant persistent bootkits that bypass Secure Boot and evade endpoint detection tools. Gigabyte confirmed fixes for three of the four flaws, but some affected, end-of-life platforms will not receive updates, leaving those devices vulnerable indefinitely. (Help Net Security)

CISA issues three Industrial Control Systems advisories

CISA published three Industrial Control Systems advisories on July 17, 2025, covering Leviton AcquiSuite and Energy Monitoring Hub products, Panoramic Corporation digital imaging software, and an update to a prior advisory for Johnson Controls' Software House C-CURE 9000 access-control platform. The agency encouraged asset owners and administrators across critical infrastructure sectors to review the technical details and apply the recommended mitigations for each affected product line to reduce exposure to exploitation. (CISA)