Week of July 21, 2025: SharePoint Attacks Escalate, CISA Adds Six KEVs

Security leaders spent the week of July 21, 2025 responding to an escalating on-premises SharePoint attack campaign that Microsoft tied to Chinese state-sponsored groups and ransomware deployment, alongside CISA's rapid additions of actively exploited SharePoint, CrushFTP, Chromium and SysAid flaws to its KEV Catalog. The same week brought a joint federal advisory on Interlock ransomware and confirmed in-the-wild exploitation of Cisco ISE and SonicWall SMA appliance vulnerabilities.

Microsoft Ties SharePoint Attacks to Chinese State Actors, Flags Ransomware Deployment

On July 24, 2025, Microsoft disclosed that three distinct threat clusters, including the China-based groups Linen Typhoon and Violet Typhoon along with Storm-2603, had been exploiting on-premises SharePoint Server flaws tracked as CVE-2025-49704 and CVE-2025-49706 since at least July 7, 2025. Microsoft reported that Storm-2603 moved beyond espionage activity to deploy Warlock ransomware on compromised servers, disabling Defender protections, harvesting credentials with Mimikatz, and manipulating Group Policy Objects to spread the encryptor across victim networks in North America and Europe. (Help Net Security)

CISA Adds Exploited SharePoint Flaws to KEV Catalog

On July 22, 2025, CISA added two Microsoft SharePoint vulnerabilities, CVE-2025-49704 and CVE-2025-49706, to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. The code-injection and improper-authentication flaws underpinned the attack chain against on-premises SharePoint servers that Microsoft and multiple security vendors had been tracking since mid-July. Federal Civilian Executive Branch agencies were required under Binding Operational Directive 22-01 to remediate the vulnerabilities by CISA's specified due date to reduce exposure to active threats. (CISA)

CISA Flags CrushFTP, Chromium and SysAid Bugs as Actively Exploited

On July 22, 2025, CISA added four more vulnerabilities to its KEV Catalog based on evidence of active exploitation: CVE-2025-54309 in CrushFTP, CVE-2025-6558 in Google Chromium's ANGLE and GPU components, and two SysAid On-Prem XML external entity flaws, CVE-2025-2776 and CVE-2025-2775. The additions required Federal Civilian Executive Branch agencies to remediate the flaws by CISA's set deadlines, and the agency urged all organizations to prioritize patching given the vulnerabilities' frequent use as attack vectors. (CISA)

CrushFTP Zero-Day Let Attackers Seize Admin Access

Reporting on July 21, 2025, Help Net Security described active exploitation of CrushFTP vulnerability CVE-2025-54309, which let unauthenticated remote attackers obtain administrative access to exposed CrushFTP web interfaces via HTTPS. The Shadowserver Foundation counted roughly 1,040 exposed and unpatched CrushFTP instances vulnerable to the flaw, concentrated in the US, Europe and Canada. CrushFTP's maintainers said the bug affected builds prior to July 1 and urged customers running CrushFTP 10 before v10.8.5 or CrushFTP 11 before v11.3.4_23 to upgrade immediately. (Help Net Security)

CISA, FBI, HHS and MS-ISAC Warn on Interlock Ransomware

On July 22, 2025, CISA joined the FBI, the Department of Health and Human Services, and the Multi-State Information Sharing and Analysis Center in publishing a joint advisory on Interlock ransomware targeting businesses and critical infrastructure across North America and Europe. The agencies described Interlock actors using drive-by downloads and the ClickFix social-engineering technique for initial access, then encrypting virtual machines while exfiltrating data under a double-extortion model. Recommended mitigations included DNS filtering, prompt patching, network segmentation and mandatory multifactor authentication. (CISA)

Cisco Confirms Exploitation of Maximum-Severity ISE Flaws

On July 23, 2025, Cisco confirmed that one or more vulnerabilities in its Identity Services Engine and ISE Passive Identity Connector were being exploited in the wild, updating its security advisory accordingly. CVE-2025-20281 and CVE-2025-20337 stemmed from insufficient input validation reachable via crafted API requests and could grant root privileges, while CVE-2025-20282 allowed unauthenticated attackers to plant malicious files in privileged directories. Cisco urged customers on ISE versions 3.3 and 3.4 to upgrade to patched releases, noting no workarounds existed. (Help Net Security)

SonicWall Patches Critical SMA Appliance Flaw, Urges Compromise Checks

On July 24, 2025, SonicWall disclosed CVE-2025-40599, a critical file-upload vulnerability in SMA 210, 410 and 500v appliances that could enable remote code execution, and urged customers to patch immediately. The advisory followed Google's disclosure of an ongoing six-month campaign delivering the OVERSTEP backdoor to end-of-life SMA devices. SonicWall recommended organizations review appliance logs for indicators of compromise, upgrade to firmware v10.2.2.1-90sv or later, reset credentials, and enforce multifactor authentication after patching. (Help Net Security)