An advanced persistent threat group, identified as Storm-2603 and believed to have ties to China, has utilized vulnerabilities in Microsoft SharePoint, named ToolShell, to install a backdoor that remains undetected on physical storage. This move was part of a larger campaign that included an attempt to deploy Warlock ransomware on the affected network. Although the ransomware was eventually blocked by security measures, the attackers successfully breached an on-premises SharePoint server.
Exploiting SharePoint Vulnerabilities
The vulnerabilities known as ToolShell involve specific Microsoft SharePoint bugs, notably CVE-2025-53770 and CVE-2025-53771. These vulnerabilities can be exploited through specially crafted web requests that allow the execution of code on a server. While other groups exploiting these flaws primarily engaged in data theft and espionage, Storm-2603’s activities were linked to ransomware deployment. Despite efforts to patch these vulnerabilities in July 2025, unpatched servers remained at risk months after the initial fixes were released.
Insight from Kaspersky’s Securelist
Researchers from Kaspersky’s Securelist documented this cyber intrusion in a report published on November 5, 2026. The analysis revealed that attackers maintained control over the IIS worker process, particularly w3wp.exe, without writing any data to disk for the backdoor component. The initial sign of the attack occurred on December 20, when a request was made to a SharePoint ToolPane endpoint to test for vulnerability to CVE-2025-53770. This request originated from infrastructure associated with ONYPHE, an internet scanning platform.
Attack Execution and Defense Measures
The full-scale intrusion took place on December 24, a time when many security teams operate with reduced staffing. The threat actor sent a crafted request from a node within the Safing Privacy Network, disguising the true origin of the attack. This request loaded a webshell into the IIS worker process, which operated in memory and disappeared upon recycling the application pool or restarting IIS. The webshell utilized a modular C# framework, with its core component, G.cs, enabling ASP.NET to serve non-existent files as pages.
Shortly after the webshell activation, the attackers used msiexec.exe to install a package from Supabase cloud storage. This package included Velociraptor, a legitimate forensics tool with known vulnerabilities, used for persistence and data collection. Despite multiple backup routes set up by the attackers, Kaspersky’s Proactive Defense Module successfully blocked the Warlock ransomware from executing its encryption process.
Recommendations for Cyber Defense
For cybersecurity professionals, mere patching is insufficient. It is crucial to apply Microsoft’s emergency SharePoint security updates, rotate exposed MachineKeys, and vigilantly monitor for signs of persistence. Unusual behavior in w3wp.exe, unexpected VirtualPathProvider registrations, and atypical outbound connections should be thoroughly investigated. Securelist advises maintaining memory and IIS logs, treating any confirmed exploitation as a comprehensive host compromise.
