Summary:
Storm-2603, a China-linked threat group, exploited the SharePoint ToolShell vulnerabilities, including CVE-2025-53770 and CVE-2025-53771, to plant a fileless backdoor in the IIS worker process of an on-premises SharePoint server and then attempted to launch Warlock ransomware on the same network. Kaspersky's Securelist team documented the intrusion in a report published on November 5, 2026, noting that the webshell ran entirely in memory and that the attackers later installed Velociraptor, Zoho Assist, VS Code tunneling, and Cloudflare Tunnel for redundant access. A vulnerable driver was used to disable endpoint protection, but Kaspersky's Proactive Defense Module blocked the ransomware before any encryption occurred. Securelist attributes the activity to Storm-2603 with moderate confidence.
Technical Description:
ToolShell is the name for a set of Microsoft SharePoint vulnerabilities, including CVE-2025-53770 and CVE-2025-53771, that allow attackers to run code on a server through specially crafted web requests. Microsoft linked the ransomware side of ToolShell exploitation to Storm-2603, while other groups using the same flaws mostly stole data and conducted espionage. This intrusion shows that unpatched servers continued to be attacked months after Microsoft's July 2025 patching. Securelist found the activity while reviewing a customer's logs in December.
The first sign was a single request to a SharePoint ToolPane endpoint on December 20 checking whether the host was vulnerable to CVE-2025-53770, followed about 12 minutes later by a connection from the bulletproof hosting provider Pfcloud UG. After three quiet days, the real intrusion began on December 24, when many security teams run with reduced staff. A crafted request from a Safing Privacy Network node loaded a webshell directly into the IIS worker process w3wp.exe, where it ran in memory and disappeared if the application pool was recycled or IIS restarted. The details and technicalities of the attack campaign are discussed further,
Delivery and Infection Chain:
The campaign relies on exploiting unpatched, internet-facing SharePoint servers and then moving quickly from an in-memory foothold to redundant remote access tools. Once those tools were in place, the attackers no longer depended on the webshell or the ToolShell flaw. The infection chain was identified as follows,
· A scanning probe checks a SharePoint ToolPane endpoint for CVE-2025-53770, followed three days later by a crafted exploit request from a Safing Privacy Network node.
· The exploit loads a modular C# webshell into the w3wp.exe IIS worker process, executing in memory without writing the backdoor to disk.
· Soon after, w3wp.exe launches msiexec.exe to install a vulnerable Velociraptor 0.73.4.0 package from Supabase cloud storage.
· Through Velociraptor, the attackers establish persistence and backup access using Zoho Assist, VS Code tunneling, Cloudflare Tunnel, and a small reverse proxy.
· The group drops the vulnerable driver rsndispot.sys and a sideloaded DLL to disable endpoint protection, then attempts to run Warlock ransomware, which Kaspersky's Proactive Defense Module blocked.
Technical Capabilities:
The webshell is a modular C# framework whose main component, G.cs, registers a custom VirtualPathProvider that lets ASP.NET serve pages that do not exist as files. It activates only when a request carries a specific User-Agent, communicates over a custom binary protocol with simple XOR scrambling, and uses the suo5 proxy tool to tunnel traffic through the SharePoint host to other machines. Other modules list running processes, logged-on users, and network connections, install MSI packages silently, and create administrator accounts through low-level Windows account calls rather than normal commands.
To obtain SYSTEM rights, the code uses a named-pipe technique copied from the EfsPotato tool, which works because IIS worker processes hold the needed impersonation privilege. Velociraptor, a legitimate forensics tool with the known flaw CVE-2025-6264, was used for persistence, discovery, data collection, and payload execution, and Cisco Talos had already described its abuse in ransomware cases tied to the same group. The multiple access routes, including Zoho Assist, VS Code tunneling, Cloudflare Tunnel, and a small reverse proxy, mean that removing one tool would not end the attackers' access.
Attribution and Evolution:
Securelist assigns the intrusion to Storm-2603 with moderate confidence, based on the ToolShell exploitation, the Warlock ransomware tools, and the group's habit of abusing Velociraptor. Storm-2603 is a China-linked group, and Microsoft linked the ransomware activity associated with ToolShell to it. The vulnerable driver rsndispot.sys and the sideloaded Warlock antivirus killer DLL are consistent with earlier findings on the actor's custom malware that abuses vulnerable drivers.
Active Campaign and Geographic Spread:
The intrusion affected an on-premises SharePoint server of a customer whose logs Securelist reviewed. The attackers used infrastructure including Safing Privacy Network nodes, traffic relays, and bulletproof hosting providers such as Pfcloud UG. The source does not identify the victim's sector or location, and unpatched servers continued to be hit months after the July 2025 patching.
Conclusion:
The attack shows that patching alone is not sufficient: attackers exploiting ToolShell can keep fileless access in memory and quickly establish redundant remote management channels. Organizations should install Microsoft's emergency SharePoint security updates, rotate exposed MachineKeys, hunt for persistence, and treat any confirmed exploit as a full host compromise.
Impact:
Successful exploitation gives attackers code execution on SharePoint servers, redundant remote access, the ability to tunnel into internal networks and create administrator accounts, and the capability to disable endpoint protection and deploy Warlock ransomware. Organizations face increased risks of data theft, ransomware encryption, and long-term compromise, while fileless backdoors that vanish after a restart complicate forensic investigation.
IOC and Context Details:
Topics
Details
Tactic Name
Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Command and Control, Impact (attempted)
Technique Name
Exploit Public-Facing Application; Server Software Component; Create Account; Remote Access Tools; Proxy; Impair Defenses; Hijack Execution Flow; Data Encrypted for Impact
Sub Technique Name
Web Shell; Local Account; Remote Desktop Software; Disable or Modify Tools; DLL
Attack Type
Malware
Targeted Applications
Microsoft SharePoint Server (on-premises); IIS worker process (w3wp.exe); Velociraptor (abused)
Region Impacted
Global
Industry Impacted
Not specified; organizations running on-premises SharePoint servers
IOC's
MD5 Hashes: FD91321BF7FF7245DDA9B7B5D791ACE8, 3A55D8F8F29716C694671834D8C6CB29, 991EC6E04413F2D4D29341C17A8A54D5, 3D553B9061C03F891CE97D7D2E64DDEE, 2C32E44A013CBFC5A323EFB7694701D2, 112A86ECA3CB5A0B5E20AB744CC5AF93, A930F81E3FB0A226EC5904D9043A17B8, 054a32d6033b1744dca7f49b2e466ea2, 2d9ebf9c042f596f435865b40edad928. IPs: 45.91.94[.]204, 49.51.132[.]100, 199.232.210[.]172, 91.224.92[.]121, 204.76.203[.]219. URLs: https[:]//vdfccjpnedujhrzscjtq[.]supabase[.]co/storage/v1/object/public/image/v4[.]msi; https[:]//auth[.]qgtxtebl[.]workers[.]dev/; https[:]//files[.]catbox[.]moe/8f7vex[.]msi. Files and Artifacts: vskp2 (webshell implant), G.cs (webshell main component), C:\Program Files\Velociraptor\Velociraptor.exe, rsndispot.sys (vulnerable driver), ZohoMeeting.7z, 7z.exe (renamed for DLL sideloading). Kaspersky Detections: Trojan.MSIL.Agent.gen, Trojan.Win64.DLLhijack.cdp.
CVE
CVE-2025-53770, CVE-2025-53771 (SharePoint ToolShell); CVE-2025-6264 (Velociraptor)
Recommended Actions:
· Install Microsoft's emergency SharePoint security updates for the ToolShell vulnerabilities (CVE-2025-53770 and CVE-2025-53771) on all on-premises SharePoint servers, and verify the patch level of each.
· Rotate exposed ASP.NET MachineKeys and related secrets on SharePoint servers, and hunt for persistence even after patching.
· Monitor w3wp.exe for unusual behavior, such as spawning msiexec.exe, cmd.exe, or PowerShell, and for new VirtualPathProvider registrations.
· Monitor outbound connections from SharePoint servers, block the listed IPs and URLs, and watch for unexpected tunnels such as Cloudflare Tunnel, VS Code tunneling, and Zoho Assist.
· Alert on installation of unapproved remote management tools and of Velociraptor, including version 0.73.4.0, and on MSI packages installed from cloud storage URLs.
· Detect loading of the vulnerable driver rsndispot.sys, sideloaded DLLs, and creation of new administrator accounts, and ensure endpoint protection has behavioral prevention enabled.
· Preserve memory images and IIS logs for forensic investigation, since the backdoor exists only in memory and disappears after an application pool recycle or IIS restart.
· Treat a confirmed exploit as a full host compromise: isolate the server, rebuild it from a trusted state, rotate credentials, and assess the network for lateral movement.
Reference: