We believe the adversary exploited a recently vulnerability in Microsoft SharePoint tracked by , which is a remote code execution vulnerability used to compromise the server and eventually install a webshell