KEVIntel Telemetry Shows Spike in SharePoint Exploitation
KEVIntel captured telemetry data revealing 12 exploitation attempts targeting CVE-2026-55040 since July 19, 2026. Eight of these attempts occurred on August 12-13,…
Tag: SharePoint
DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts
A sophisticated device code phishing campaign targeting Microsoft 365 accounts has been observed between late June and early July 2026, leveraging collaboration-themed…
Storm-2603: Threat Actor Deploying Warlock Ransomware via SharePoint Exploits
A threat actor known for deploying Warlock ransomware by exploiting vulnerabilities in on-premises SharePoint servers since mid-2025. Uses tools like Velociraptor, Cloudflare…
Warlock Ransomware: Deployed by Storm-2603 in SharePoint Attacks
Ransomware deployed by threat actor Storm-2603, often exploiting known vulnerabilities in on-premises SharePoint servers. Used in parallel with other techniques to establish…
Microsoft SharePoint Authentication Bypass Under Active Attack
Microsoft SharePoint is the affected product in CVE-2026-55040, a critical authentication bypass vulnerability. The flaw allows unauthenticated attackers to forge JWT tokens…
Microsoft Graph API: Used for C2 Tasking
TWINLOOT authenticates to an attacker's Azure tenant and uses the Graph API to interact with SharePoint drives for command and control.
Microsoft SharePoint Security Bypass
Microsoft SharePoint vulnerability (CVE-2026-55040) allows security feature bypass and is under active exploitation.