security.com · Crawled Jul 25, 2026

ToolShell Used to Compromise Telecoms Company in Middle East | SECURITY.COM

16 IoCs 8 Actors 3 Malware
Read original article ↗

AI Summary

China-based threat actors exploited the ToolShell vulnerability (CVE-2025-53770) to compromise a telecoms company in the Middle East and multiple government agencies globally shortly after the patch was released in July 2025. The attackers deployed backdoors such as Zingdoor and ShadowPad, used DLL sideloading techniques, and leveraged tools like KrustyLoader and Sliver for post-exploitation. Activities indicate espionage motives, with credential theft and lateral movement observed across compromised networks.

AI-extracted · verify before operational use

Extracted Entities 11 found

Malware ShadowPad → Malware KrustyLoader → Malware Sliver → Threat Actor Earth Estries → Threat Actor GhostEmperor → Threat Actor UTA0178 → Threat Actor APT27 → Threat Actor APT31 → Threat Actor Storm-2603 → Threat Actor APT41 → Threat Actor Redfly →

Indicators of Compromise 16 extracted

Type Value Detail
SHA-256 6240e39475f04bfe55ab7cba8746bd08901d7678b1c7742334d56f2bc8620a35 Details →
SHA-256 929e3fdd3068057632b52ecdfd575ab389390c852b2f4e65dc32f20c87521600 Details →
SHA-256 db15923c814a4b00ddb79f9c72f8546a44302ac2c66c7cc89a144cb2c2bb40fa Details →
SHA-256 e6c216cec379f418179a3f6a79df54dcf6e6e269a3ce3479fd7e6d4a15ac066e Details →
SHA-256 071e662fc5bc0e54bcfd49493467062570d0307dc46f0fb51a68239d281427c6 Details →
SHA-256 1f94ea00be79b1e4e8e0b7bbf2212f2373da1e13f92b4ca2e9e0ffc5f93e452b Details →
SHA-256 dbdc1beeb5c72d7b505a9a6c31263fc900ea3330a59f08e574fd172f3596c1b8 Details →
SHA-256 6aecf805f72c9f35dadda98177f11ca6a36e8e7e4348d72eaf1a80a899aa6566 Details →
SHA-256 568561d224ef29e5051233ab12d568242e95d911b08ce7f2c9bf2604255611a9 Details →
SHA-256 28a859046a43fc8a7a7453075130dd649eb2d1dd0ebf0abae5d575438a25ece9 Details →
SHA-256 7be8e37bc61005599e4e6817eb2a3a4a5519fded76cb8bf11d7296787c754d40 Details →
SHA-256 5b165b01f9a1395cae79e0f85b7a1c10dc089340cf4e7be48813ac2f8686ed61 Details →
SHA-256 e4ea34a7c2b51982a6c42c6367119f34bec9aeb9a60937836540035583a5b3bc Details →
SHA-256 7803ae7ba5d4e7d38e73745b3f321c2ca714f3141699d984322fa92e0ff037a1 Details →
SHA-256 7acf21677322ef2aa835b5836d3e4b8a6b78ae10aa29d6640885e933f83a4b01 Details →
SHA-256 6c48a510642a1ba516dbc5effe3671524566b146e04d99ab7f4832f66b3f95aa Details →

MITRE ATT&CK TTPs 87 techniques

T1003.001 LSASS Memory · Credential Access T1021.001 Remote Desktop Protocol · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1055.001 Dynamic-link Library Injection · Defense Evasion T1057 Process Discovery · Discovery T1059.001 PowerShell · Execution T1071.001 Web Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1087.002 Domain Account · Discovery T1090 Proxy · Command And Control T1105 Ingress Tool Transfer · Command And Control T1124 System Time Discovery · Discovery T1133 External Remote Services · Persistence T1210 Exploitation of Remote Services · Lateral Movement T1558 Steal or Forge Kerberos Tickets · Credential Access T1566 Phishing · Initial Access T1014 Rootkit · Defense Evasion T1016 System Network Configuration Discovery · Discovery T1053.005 Scheduled Task · Execution T1055 Process Injection · Defense Evasion T1056.003 Web Portal Capture · Collection T1059.003 Windows Command Shell · Execution T1070.004 File Deletion · Defense Evasion T1071 Application Layer Protocol · Command And Control T1071.004 DNS · Command And Control T1074.001 Local Data Staging · Collection T1080 Taint Shared Content · Lateral Movement T1090.004 Domain Fronting · Command And Control T1095 Non-Application Layer Protocol · Command And Control T1098.004 SSH Authorized Keys · Persistence T1112 Modify Registry · Defense Evasion T1113 Screen Capture · Collection T1140 Deobfuscate/Decode Files or Information · Defense Evasion T1195.001 Compromise Software Dependencies and Development Tools · Initial Access T1204.002 Malicious File · Execution T1485 Data Destruction · Impact T1496 Resource Hijacking · Impact T1547.001 Registry Run Keys / Startup Folder · Persistence T1555 Credentials from Password Stores · Credential Access T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay · Credential Access T1647 Plist File Modification · Defense Evasion T1190 Exploit Public-Facing Application · Initial Access T1571 Non-Standard Port · Command And Control T1574.001 DLL Search Order Hijacking · Persistence T1665 Hide Infrastructure · Command And Control T1078.002 Domain Accounts · Defense Evasion T1098.002 Additional Email Delegate Permissions · Persistence T1110.001 Password Guessing · Credential Access T1136.001 Local Account · Persistence T1499 Endpoint Denial of Service · Impact T1543.001 Launch Agent · Persistence T1556.004 Network Device Authentication · Credential Access T1003 OS Credential Dumping · Credential Access T1018 Remote System Discovery · Discovery T1071.003 Mail Protocols · Command And Control T1218.001 Compiled HTML File · Defense Evasion T1573.001 Symmetric Cryptography · Command And Control T1021.004 SSH · Lateral Movement T1048 Exfiltration Over Alternative Protocol · Exfiltration T1053 Scheduled Task/Job · Execution T1070 Indicator Removal · Defense Evasion T1087 Account Discovery · Discovery T1102 Web Service · Command And Control T1110.003 Password Spraying · Credential Access T1111 Multi-Factor Authentication Interception · Credential Access T1204.001 Malicious Link · Execution T1219 Remote Access Software · Command And Control T1484 Domain or Tenant Policy Modification · Defense Evasion T1486 Data Encrypted for Impact · Impact T1526 Cloud Service Discovery · Discovery T1534 Internal Spearphishing · Lateral Movement T1564.008 Email Hiding Rules · Defense Evasion T1567 Exfiltration Over Web Service · Exfiltration T1572 Protocol Tunneling · Command And Control T1621 Multi-Factor Authentication Request Generation · Credential Access T1663 T1663 T1687 T1687 T1036 Masquerading · Defense Evasion T1036.005 Match Legitimate Name or Location · Defense Evasion T1129 Shared Modules · Execution T1135 Network Share Discovery · Discovery T1170 T1170 T1197 BITS Jobs · Defense Evasion T1205.001 Port Knocking · Defense Evasion T1566.001 Spearphishing Attachment · Initial Access