Threat actors linked to China exploited the ToolShell vulnerability (CVE-2025-53770) in Microsoft SharePoint to breach a Middle Eastern telecommunications company shortly after its public disclosure in July 2025. The attack involved bypassing authentication and achieving remote code execution (RCE) on on-premise SharePoint servers, enabling persistent and stealthy access for credential theft and espionage. The Salt Typhoon (Glowworm) group deployed malicious tools like Zingdoor, ShadowPad, and KrustyLoader, a Rust-based loader previously tied to China-nexus espionage campaigns. The attackers aimed to exfiltrate sensitive data, establish long-term access, and likely gather intelligence for geopolitical or economic advantage. While no explicit data leak was confirmed, the compromise of a telecom provider—a critical infrastructure sector—poses risks to national security, customer privacy, and regional stability. The attack aligns with broader campaigns targeting government agencies, universities, and financial institutions globally, suggesting a coordinated effort by multiple Chinese state-sponsored groups. The use of living-off-the-land (LotL) techniques and privilege escalation exploits (e.g., CVE-2021-36942/PetitPotam) further obscured detection, increasing the potential for unauthorized lateral movement across networks.