ToolShell - Vulnerability

Threat entity extracted from intelligence sources

Frequency
8
occurrences
First Seen
October 30, 2025
Last Seen
April 22, 2026

ToolShell is a vulnerability tracked by ThreatCluster, appearing in 7 threat clusters built from 8 intelligence report mentions.

ToolShell is a vulnerability tracked across 7 threat clusters and 8 intelligence report mentions on ThreatCluster. First observed October 30, 2025; most recent activity April 22, 2026.

Related Threat Clusters

  • Phishing Surges as Leading Initial Access Method in Q1 2026

    In the first quarter of 2026, phishing has returned as the primary method for attackers to gain initial access to organizations, accounting for over a third of such engagements, as reported by Cisco Talos. This marks…

    2 articles · Updated April 22, 2026
  • Shift in Ransomware Tactics Targeting Cloud Assets

    Ransomware actors are increasingly focusing on cloud-based assets, particularly in AWS environments. This shift involves utilizing various tactics to compromise critical business data, moving away from traditional…

    56 articles · Updated November 19, 2025
  • Microsoft January 2026 Patch Tuesday Addresses 114 Vulnerabilities

    On January 10, 2026, Microsoft released its Patch Tuesday updates, fixing 114 vulnerabilities, including three classified as zero-day flaws. These updates affect various Microsoft products and are crucial for…

    61 articles · Updated January 14, 2026
  • Vulnerability Exploits Account for 40% of Intrusions in Q4 2025

    In Q4 2025, vulnerability exploits were responsible for nearly 40 percent of all cybersecurity intrusions, according to Cisco Talos. Security experts are advising teams to patch vulnerabilities promptly to mitigate…

    2 articles · Updated January 29, 2026
  • Warlock Ransomware Exploits ToolShell SharePoint Vulnerabilities

    Warlock ransomware has been deployed through vulnerabilities in ToolShell SharePoint. Organizations using affected SharePoint versions are at risk, as the ransomware exploits chained vulnerabilities to gain access.…

    2 articles · Updated October 30, 2025
  • Warlock Ransomware Exploits ToolShell SharePoint Vulnerabilities

    Warlock ransomware has been deployed using vulnerabilities in ToolShell SharePoint. The attack leverages chained vulnerabilities to gain access and encrypt data. Organizations using affected SharePoint systems are at…

    2 articles · Updated October 30, 2025
  • Microsoft Issues Mitigations for 1,246 Vulnerabilities in 2025

    In 2025, Microsoft addressed a total of 1,246 Common Vulnerabilities and Exposures (CVEs), with 158 classified as critical. Among these, 41 were zero-day vulnerabilities, and a significant portion, 38.3%, were related…

    1 article · Updated December 30, 2025

Recent Intelligence Reports

  • Phishing reclaims the top initial access spot, attackers experiment with AI tools — Feeds2.Feedburner · April 22, 2026
  • Patch or perish: Vulnerability exploits now dominate intrusions — Theregister · January 29, 2026
  • Patch or perish: Vulnerability exploits now dominate intrusions — Theregister · January 29, 2026
  • January 2026 Microsoft Patch Tuesday: Actively exploited zero day needs attention — Csoonline · January 14, 2026
  • Patch Tuesday 2025 roundup: The biggest Microsoft vulnerabilities of the year — Csoonline · December 30, 2025
  • Q3 ransomware activity dominated by three groups, stolen VPN credential use — Scworld · November 20, 2025
  • A Deep Dive Into Warlock Ransomware Deployed Via ToolShell SharePoint Chained Vulnerabilities — Reddit · October 30, 2025
  • A Deep Dive Into Warlock Ransomware Deployed Via ToolShell SharePoint Chained Vulnerabilities — Reddit · October 30, 2025

Frequently asked questions

What is ToolShell?

ToolShell is a vulnerability tracked by ThreatCluster, appearing in 7 threat clusters built from 8 intelligence report mentions.

Is ToolShell still active?

The most recent intelligence report mentioning ToolShell on ThreatCluster is dated April 22, 2026. Activity was first observed October 30, 2025, giving a tracked span from then to April 22, 2026.

What is ToolShell associated with?

Across ThreatCluster reporting, ToolShell most frequently co-occurs with Stealth Falcon, Malware, Phishing, Ransomware, Sql Injection, among 12 tracked related entities.

What are the latest developments involving ToolShell?

The most significant recent cluster is “Phishing Surges as Leading Initial Access Method in Q1 2026” (2 articles · Updated April 22, 2026). ToolShell appears across 7 threat clusters in total, listed above with sources.

How much reporting does ThreatCluster have on ToolShell?

ToolShell appears in 8 intelligence report mentions across 7 deduplicated threat clusters, aggregated from 17,000+ monitored sources.

CVSS v3.1 Breakdown