Storm-2603 Hackers Exploit SharePoint ToolShell Flaws to Hide Fileless Backdoor and Launch Ransomware Attack

A China-linked threat group tracked as Storm-2603 has used the SharePoint ToolShell flaws to plant a backdoor that never touches the disk.

The group then tried to run Warlock ransomware on the same network. The break-in hit an on-premises SharePoint server and ended with a ransomware launch that security software blocked.

ToolShell is the name for a set of Microsoft SharePoint bugs, including CVE-2025-53770 and CVE-2025-53771. They let an attacker run code on a server through specially crafted web requests.

Microsoft linked the ransomware side of this activity to Storm-2603, while other groups using the same flaws mostly stole data and spied. Defenders who thought July 2025 patching closed the story should note that unpatched servers were still being hit months later.

Researchers at Securelist, the threat research arm of Kaspersky, identified and documented this intrusion in a report published on November 5, 2026.

Their team found the activity in a December review of a customer’s logs. They noted that the attackers kept control inside the IIS worker process, w3wp.exe, and wrote nothing to disk for the backdoor itself. You can read the full Securelist analysis for the technical details.

Storm-2603 Hackers Exploit SharePoint ToolShell Flaws

The first sign was small. On December 20, a single request hit a SharePoint ToolPane endpoint to check whether the host was vulnerable to CVE-2025-53770. It came from infrastructure tied to ONYPHE, an internet scanning platform.

About 12 minutes later, a second connection arrived from a bulletproof hosting provider, Pfcloud UG. Nothing was exploited yet, and three quiet days followed.

Because of that gap, the team first rated the probe as low priority. The real intrusion came on December 24, Christmas Eve, when many security teams run with fewer staff.

The attacker sent a crafted request from 45.91.94[.]204, a Safing Privacy Network node that hides the true source behind several relays.

That request loaded a webshell straight into the IIS worker process. It ran in memory and vanished if the application pool was recycled or IIS restarted. This matches what earlier reports on the ToolShell zero-day and Warlock ransomware warned about.

The webshell was a modular C# framework. Its main part, G.cs, registered a custom VirtualPathProvider, which lets ASP.NET serve pages that do not exist as files.

It woke up only when a request carried a specific User-Agent, so normal traffic never triggered it. It talked to the attacker over a custom binary protocol with simple XOR scrambling.

It also used the suo5 proxy tool to tunnel traffic through the SharePoint host, which let the attackers reach other machines inside the network.

Other modules listed running processes, logged-on users and network connections. One installed MSI packages silently, and another created admin accounts through low-level Windows account calls instead of normal commands.

For SYSTEM rights, the code used a named-pipe trick copied from the EfsPotato tool, which works because IIS worker processes hold the needed impersonation privilege.

Velociraptor, Tunnels and a Blocked Warlock Launch

Soon after the webshell ran, the worker process started msiexec.exe to install a package from Supabase cloud storage. The package was Velociraptor version 0.73.4.0, a real forensics tool with a known flaw, CVE-2025-6264.

Cisco Talos had already described Velociraptor abused in ransomware cases tied to the same group. Here, the attackers used it for persistence, discovery, data collection and running payloads.

Through Velociraptor, they set up several backup routes: Zoho Assist, VS Code tunneling, Cloudflare Tunnel and a small reverse proxy. With so many paths, deleting one tool would not end their access.

They also stopped depending on the webshell or the ToolShell bug at this point. The group then dropped a vulnerable driver, rsndispot.sys, to shut down endpoint protection.

A sideloaded DLL, flagged as Warlock’s antivirus killer, was likely meant to use it. This fits earlier findings on custom malware that abuses BYOVD from the same actor.

The final step failed. Kaspersky’s Proactive Defense Module blocked the Warlock ransomware process before it could encrypt anything.

Securelist assigns the case to Storm-2603 with moderate confidence, based on the ToolShell use, the Warlock tools and the Velociraptor habits.

For defenders, patching is not enough. Install Microsoft’s emergency SharePoint security updates, then rotate exposed MachineKeys and hunt for persistence.

Watch for odd w3wp.exe behavior, new VirtualPathProvider registrations, unexpected outbound connections and new remote-management tools. Securelist also advises keeping memory and IIS logs, and treating a confirmed exploit as a full host compromise.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Storm-2603 Hackers Exploit SharePoint ToolShell Flaws to Hide Fileless Backdoor and Launch Ransomware Attack appeared first on Cyber Security News.