/2d%20illustration%20of%20Cloud%20computing%20by%20Blackboard%20via%20Shutterstock.jpg)
Some administrators who logged in last week found their on-premises Microsoft SharePoint servers silently uploading web shells instead of documents. A single, carefully forged packet had slipped past every guardrail and granted attackers full remote control before any human had typed a password.
What unfolded is now known as the ToolShell exploit chain. Security researchers at the Dutch firm Eye Security noticed an unusual file on a client’s server and sounded the alarm.
