Chinese Threat Actors Exploit Zero-Day ToolShell Vulnerability in Global Cyber Espionage Campaign New research from Symantec reveals that China-linked threat actors exploited the recently patched ToolShell vulnerability (CVE-2025-53770) to breach a telecommunications company in the Middle East and government agencies across Africa and South America in July 2025. The attacks, which began just days after Microsoft released patches, highlight the rapid weaponization of zero-day flaws by state-backed cyber operatives. The campaign involved the deployment of Zingdoor, a Go-based HTTP backdoor previously attributed to the Chinese group Glowworm (Earth Estries/FamousSparrow), and KrustyLoader, a Rust-written malware linked to UNC5221, another China-nexus actor. Additional victims included a state technology agency in Africa, a Middle Eastern government department, and a European finance company. Attackers also leveraged ShadowPad, a modular Trojan, and the Sliver command-and-control framework, often abused for post-exploitation activities. ToolShell, a critical flaw in on-premise SharePoint servers, allowed unauthenticated remote code execution and full system access. Microsoft confirmed that at least three Chinese groups Budworm (Linen Typhoon), Sheathminer (Violet Typhoon), and Storm-2603 exploited the vulnerability, with Storm-2603 deploying Warlock ransomware in some attacks. A related path traversal bug (CVE-2025-53771) was patched simultaneously. The attackers used a mix of living-off-the-land binaries (LOLBins) and publicly available tools, including: - Certutil (file download/decode) - GoGo Scanner (automated network scanning) - Revsocks (SOCKS5 proxy for firewall evasion) - Procdump/Minidump/LsassDumper (credential harvesting) - PetitPotam (CVE-2021-36942) (LSA spoofing for lateral movement) Symantec’s investigation found that malicious activity in the Middle Eastern telecom firm began on July 21, 2025, with attackers sideloading Zingdoor via a legitimate Trend Micro binary and later deploying KrustyLoader on July 25. The campaign’s scale suggests mass scanning for vulnerable systems, followed by targeted intrusions for espionage and persistent access. While overlaps exist with Glowworm’s past operations, Symantec could not conclusively attribute the attacks to a single group, though all evidence points to China-based actors. The incidents underscore the global reach of state-sponsored cyber threats and the urgency of patching critical vulnerabilities even as attackers exploit them within days of disclosure.