ToolShell is a vulnerability tracked by ThreatCluster, appearing in 7 threat clusters built from 8 intelligence report mentions.
ToolShell is a vulnerability tracked across 7 threat clusters and 8 intelligence report mentions on ThreatCluster. First observed October 30, 2025; most recent activity April 22, 2026.
In the first quarter of 2026, phishing has returned as the primary method for attackers to gain initial access to organizations, accounting for over a third of such engagements, as reported by Cisco Talos. This marks…
Ransomware actors are increasingly focusing on cloud-based assets, particularly in AWS environments. This shift involves utilizing various tactics to compromise critical business data, moving away from traditional…
On January 10, 2026, Microsoft released its Patch Tuesday updates, fixing 114 vulnerabilities, including three classified as zero-day flaws. These updates affect various Microsoft products and are crucial for…
In Q4 2025, vulnerability exploits were responsible for nearly 40 percent of all cybersecurity intrusions, according to Cisco Talos. Security experts are advising teams to patch vulnerabilities promptly to mitigate…
Warlock ransomware has been deployed through vulnerabilities in ToolShell SharePoint. Organizations using affected SharePoint versions are at risk, as the ransomware exploits chained vulnerabilities to gain access.…
Warlock ransomware has been deployed using vulnerabilities in ToolShell SharePoint. The attack leverages chained vulnerabilities to gain access and encrypt data. Organizations using affected SharePoint systems are at…
In 2025, Microsoft addressed a total of 1,246 Common Vulnerabilities and Exposures (CVEs), with 158 classified as critical. Among these, 41 were zero-day vulnerabilities, and a significant portion, 38.3%, were related…
ToolShell is a vulnerability tracked by ThreatCluster, appearing in 7 threat clusters built from 8 intelligence report mentions.
The most recent intelligence report mentioning ToolShell on ThreatCluster is dated April 22, 2026. Activity was first observed October 30, 2025, giving a tracked span from then to April 22, 2026.
Across ThreatCluster reporting, ToolShell most frequently co-occurs with Stealth Falcon, Malware, Phishing, Ransomware, Sql Injection, among 12 tracked related entities.
The most significant recent cluster is “Phishing Surges as Leading Initial Access Method in Q1 2026” (2 articles · Updated April 22, 2026). ToolShell appears across 7 threat clusters in total, listed above with sources.
ToolShell appears in 8 intelligence report mentions across 7 deduplicated threat clusters, aggregated from 17,000+ monitored sources.