MalwareExploits 4 CVEs

LeakFang

LeakFang is a .NET backdoor associated with post-exploitation activity on compromised on-premises Microsoft SharePoint Server environments. It has been observed in intrusion activity following exploitation of SharePoint vulnerabilities, where attackers gain unauthorized access, steal IIS-protected secrets such as machine keys, and use those secrets to support continued access and persistence. Microsoft Defender identifies this activity as Backdoor:MSIL/LeakFang.A!dha.

The malware is linked to attacks against SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Its observed role is not initial compromise but follow-on malicious activity after server exploitation. Reported operator objectives in the surrounding intrusion set include harvesting IIS machine keys, enabling deserialization-based persistence, and deploying malware on affected servers. The responsible threat actors have not been publicly attributed to a named group.

LeakFang should be understood as part of a broader SharePoint post-compromise tradecraft cluster rather than a mass-distributed commodity threat. High-confidence reporting supports its use as a backdoor on Windows-based SharePoint servers and its association with theft of protected server secrets and persistence-related post-exploitation activity.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

4 CVES

CVE-2026-32201Microsoft SharePoint Server Spoofing Vulnerability

MDAV: Backdoor:MSIL/LeakFang.A!dha – post-exploitation activity alert involving IIS-protected secrets.

via tt csirt advisoriesttcsirt.gov.tt

CVE-2026-45659Remote Code Execution in Microsoft SharePoint Server via Deserialization of Untrusted Data

MDAV: Backdoor:MSIL/LeakFang.A!dha – post-exploitation activity alert involving IIS-protected secrets.

via tt csirt advisoriesttcsirt.gov.tt

CVE-2026-58644Microsoft SharePoint Deserialization Remote Code Execution

MDAV: Backdoor:MSIL/LeakFang.A!dha – post-exploitation activity alert involving IIS-protected secrets.

via tt csirt advisoriesttcsirt.gov.tt

CVE-2026-56164Microsoft SharePoint Server Missing Authentication for Critical Function Privilege Escalation

MDAV: Backdoor:MSIL/LeakFang.A!dha – post-exploitation activity alert involving IIS-protected secrets.

via tt csirt advisoriesttcsirt.gov.tt

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1587Develop CapabilitiesEvidence1

performing deserialization techniques, to gain persistence and deploy malware.

Execution

2 techniques

T1053Scheduled Task/JobEvidence1

...performing deserialization techniques, to gain persistence and deploy malware.

T1203Exploitation for Client ExecutionEvidence1

These vulnerabilities affect all supported on-premises SharePoint Server versions (Subscription Edition, 2019, and 2016) and involve establishing remote code execution (RCE) and post-exploitation activities...

Persistence

1 technique

T1053Scheduled Task/JobEvidence1

...performing deserialization techniques, to gain persistence and deploy malware.

Privilege Escalation

1 technique

T1053Scheduled Task/JobEvidence1

...performing deserialization techniques, to gain persistence and deploy malware.

Credential Access

1 technique

T1649Steal or Forge Authentication CertificatesEvidence4

post-exploitation activities, such as stealing Internet Information Services (IIS) machine keys

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

...performing deserialization techniques, to gain persistence and deploy malware.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

truesecNews

Jul 20, 2026

Microsoft SharePoint Server Vulnerabilities Actively Exploited - Truesec

A backdoor detected by Microsoft Defender Antivirus in post-exploitation activity involving IIS-protected secrets during SharePoint exploitation.

security online infoNews

Jul 15, 2026

CISA: 3 SharePoint Vulnerabilities Exploited in the Wild

A backdoor malware family referenced as a Defender detection to monitor for during SharePoint intrusion hunting.

labs beazley securityNews

Jul 14, 2026

SharePoint Vulnerabilities Under Active Exploitation, CISA Urges SharePoint Hardening

A named backdoor detection associated with post-exploitation activity on SharePoint servers, specifically involving access to IIS-protected secrets.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities4

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

LeakFang