5 min read
SharePoint ToolShell (CVE-2025-53770): patch, rotate keys, then hunt
How the July 2025 ToolShell attacks on on-premises SharePoint worked, who is affected, and why patching alone does not remove the attacker.

A 24/7 security operations centre watching your environment year-round, with security practices aligned to Essential Eight and NIST.
An example of how it works
Before anyone tries the door.
Your systems are kept patched and set up to Essential Eight, and vulnerability scanning finds weak spots before an attacker does.
A phishing email gets through, and a password is stolen.
Every sign-in and device is logged to our SIEM, and our 24/7 security operations centre is watching.
Someone signs in as your staff member from an unusual place.
Managed detection and response flags it.
Contained.
We lock the account, cut the attacker off, and our incident response team checks what they touched and gets your people working again.
Post-incident review
Geidi is so much more than just our 'IT Support'. With a proactive approach to our IT needs combined with their expertise across a number of fields they have become an integral part of our team. I am happy to share credit with them for our business success and quite simply with Geidi they deliver what they promise, on time and on budget.
A 24/7 security operations centre watching your environment year-round, with security practices aligned to Essential Eight and NIST.
Our approach is process-first. We start by understanding how your company's processes actually run, then choose the technology to support them. We work with organisations of 5 to 1,000 staff, Perth-based and Australia wide. A staged method with review gates and support. Risk is managed at every stage.
Based on our initial contact with you about your operations, we listen, analyse and review your needs. If there is a fit, we then work with you to identify a low-risk first step to begin our journey with you.
5 min read
How the July 2025 ToolShell attacks on on-premises SharePoint worked, who is affected, and why patching alone does not remove the attacker.
7 min read
A first-hours guide for Perth and WA organisations hit by ransomware, a hacked mailbox or a scam: what to do first, and who to report it to.
6 min read
How infostealer malware such as Lumma steals browser passwords and session cookies, why MFA doesn't stop a stolen session, and the settings that do.
The support, security, cloud and infrastructure your business relies on, run by an experienced Perth team for organisations of 5 to 1,000 staff, across WA and Australia.
See managed it overviewA 7-day service desk with unlimited incident and onsite support, plus fixed-cost coverage of the servers, networks and remote access your business depends on.
Explore Managed IT & SupportMicrosoft 365, SharePoint, Dynamics 365, hosted infrastructure, custom software and websites, implemented and run as one environment.
Explore Cloud & Business SystemsGeidi AI, our newest division. Practical AI and automation, built safely on the Microsoft 365 environments and security we already manage.
Explore AI & AutomationGeidi AI, in production
Add or remove a staff member in one step: account, licence, laptop and welcome email, even scheduled for their start date. Geidi estimates about 40 minutes saved per new starter.
IT Portal on geidi.aiTell us about your existing IT. We would be pleased to review your current system and give you an overview as to how Geidi may be able to deliver and enhance your IT operations.