A China-linked cyber threat actor known as Storm-2603 has leveraged SharePoint ToolShell vulnerabilities to implant a fileless backdoor and push toward a ransomware attack. The compromised server, located on-premises, was breached using critical weaknesses in Microsoft SharePoint—specifically CVE-2025-53770 and CVE-2025-53771—which enabled attackers to execute code via crafted web requests. Although the final ransomware deployment was blocked, the operation marks a sophisticated escalation involving stealthy techniques and multi-stage intrusion methods.
How the Attack Unfolded
Security analysts uncovered this intrusion by reviewing client server logs — the first suspicious activity was detected on December 20, when a probing request targeted a SharePoint ToolPane endpoint to check for vulnerability to CVE-2025-53770. Twelve minutes later, another connection arrived via a bulletproof hosting provider, but no active exploit emerged until December 24. That timeframe aligns with low staffing during the holiday season.
The attackers used that exploit window to load a webshell directly into the IIS worker process (w3wp.exe), residing in memory only—meaning no files were written to disk. The implant was a modular C# framework that registered a custom VirtualPathProvider, enabling the server to serve non-existent files. The implant only activated when receiving requests with a specific User-Agent header, and communicated with its controllers using a custom XOR-scrambled protocol.
From there, additional tools and tactics emerged. A vulnerability in Velociraptor (version 0.73.4.0, tied to CVE-2025-6264) was abused for discovery, persistence, moving laterally, and data collection. Attackers established multiple fallback channels including VS Code tunneling, Zoho Assist, Cloudflare Tunnel, and a reverse proxy, ensuring access even if portions of the infrastructure were disabled. To bypass endpoint protections, they deployed a vulnerable driver (rsndispot.sys) and loaded a malicious DLL labeled an antivirus-killer. System-level privilege escalation was achieved using a named pipe exploit derived from EfsPotato, exploiting inherent impersonation rights in IIS worker processes.
Ransomware Attempt & Indicators of Compromise
While the group attempted to deploy Warlock ransomware at the end of the chain, security software intervened and blocked the malicious process before any encryption could occur. The attribution to Storm-2603 was made based on the confluence of tools and tactics—ToolShell exploitation, Velociraptor misuse, and Warlock ties matched known patterns.
Researchers provided a list of indicators of compromise (IoCs) including IP addresses, domain names, hashes of malicious DLLs, and specific tools used. These include blocked addresses like 45.91.94[.]204, executable artifacts such as renamed bore-into trusted tools (e.g. 7z.exe, VS Code), usage of Supabase storage for malicious installer packages, alongside misused tunneling tools and vulnerable drivers.
Importantly, many victim organizations had not patched the ToolShell vulnerabilities—even though Microsoft issued emergency updates in July 2025 addressing them. This suggests lingering risk in unpatched environments, particularly where SharePoint remains internet-facing.
What Defenders Should Do
- Apply Microsoft’s emergency patches for the identified SharePoint bugs immediately.
- Rotate any MachineKeys that might have been exposed.
- Hunt for persistence mechanisms: trace unusual behavior in w3wp.exe, look for VirtualPathProvider registrations, unexpected outbound traffic, or use of remote management/tunneling tools.
- Preserve logs for memory and IIS to detect in-memory backdoors.
- Treat any confirmed compromise as a full host breach.
This incident illustrates how fileless attacks using ToolShell flaws allow actors like Storm-2603 to evade detection, maintain long-term access, and prepare for large-scale damage. It underscores the urgent need for proactive defense in patch management, telemetry visibility, and incident response readiness.
