Hackers Exploit SharePoint Zero-Day Since July 7 to Steal Keys, Maintain Persistent Access

Check Point Research has identified widespread active exploitation of critical Microsoft SharePoint vulnerabilities (CVE-2025-53770, CVE-2025-49706) since early July 2025, targeting government, telecommunications, and critical infrastructure sectors globally. Attackers are leveraging these flaws to achieve remote code execution and exfiltrate sensitive cryptographic keys, enabling persistent access and command execution even after patches are applied. Mandiant attributes early exploitation to a China-aligned threat group, underscoring the sophisticated nature of the campaign and the paramount urgency for affected organizations to apply patches, rotate keys, and restart instances to mitigate the significant risk of ongoing compromise and data theft.

Analysis

Active, widespread exploitation of a critical remote code execution vulnerability in on-premise Microsoft SharePoint servers (CVE-2025-53770) presents a significant and immediate threat to global organizations. Research from multiple cybersecurity firms, including Check Point and SentinelOne, confirms that sophisticated attacks, attributed by Google's Mandiant to a China-aligned threat actor, have been ongoing since at least July 7, 2025. The campaign targets high-value sectors such as government, telecommunications, and critical infrastructure across North America and Western Europe. The attack methodology is particularly severe, as it focuses on stealing cryptographic machine keys to enable persistent access, potentially rendering initial software patches insufficient for full remediation. This event creates a material reputational and operational risk for Microsoft (MSFT), whose initial patches were bypassed. Conversely, it serves as a powerful validation for cybersecurity providers like CrowdStrike (CRWD), SentinelOne (S), and Check Point (CHKP), who have demonstrated their ability to detect and block these advanced, fileless attacks, reinforcing the non-discretionary nature of enterprise cybersecurity spending.

Key Decisions for Investors

• Investors in Microsoft (MSFT) should monitor for potential customer attrition from on-premise products and any disclosed financial impact, as this vulnerability highlights significant security risks in its widely deployed enterprise software.
• This event represents a strong tailwind for cybersecurity firms like CrowdStrike (CRWD), SentinelOne (S), and Palo Alto Networks (PANW), whose threat intelligence and endpoint protection platforms are being showcased, potentially accelerating sales cycles and market share gains.
• Portfolio managers should assess the cybersecurity posture of holdings in targeted sectors like telecommunications and critical infrastructure, as the reported theft of cryptographic keys creates a latent risk of ongoing compromise even in patched environments.