Storm-2603 chains SharePoint ToolShell flaws into a fileless, in-memory backdoor before attempting Warlock ransomware

What happened

• On 5 November 2026, Kaspersky’s Securelist published “The SOC Files 5,” a retrospective analysis of a fileless SharePoint breach it attributes to Storm-2603 (Kaspersky).
• The target was an internet-facing, on-premises SharePoint server belonging to a customer; neither source names the victim or its sector (Kaspersky).
• Cyber Security News describes Storm-2603 as a China-linked threat group and reports that Microsoft linked the ransomware side of this ToolShell activity to Storm-2603, while other groups using the same flaws “mostly stole data and spied” (Cyber Security News).
• Kaspersky assigns this case to Storm-2603 with moderate confidence, citing the group’s prior use of Warlock and LockBit after SharePoint exploitation, its Velociraptor habits, and a Cisco Talos report linking Velociraptor misuse to the actor (Kaspersky).
• Timeline (the sources do not state the year of the December events): Dec 20 a non-intrusive ToolPane probe arrived from ONYPHE-associated infrastructure, followed about 12 minutes later by a connection from bulletproof-hosting provider Pfcloud UG; after three quiet days, the Dec 24 (Christmas Eve) intrusion sent the exploit from 45.91.94[.]204, a Safing Privacy Network node; the incident was discovered Dec 26 (Kaspersky; Cyber Security News).
• Kaspersky notes unpatched servers were still being hit months after the July 2025 ToolShell patching (Cyber Security News).

How it works

ToolShell CVEs. ToolShell is a set of SharePoint bugs, including CVE-2025-53770 and CVE-2025-53771, that allow code execution through crafted web requests; the initial probe targeted CVE-2025-53770 via a SharePoint ToolPane endpoint (Kaspersky; Cyber Security News).

Fileless webshell. The crafted request loaded a webshell into the IIS worker process (w3wp.exe) in memory, with nothing written to disk; it disappears if the application pool recycles or IIS restarts. Kaspersky’s wording: “The payload was not written to disk” (Kaspersky).

In-memory implant (G.cs). The core component registered a custom VirtualPathProvider, via the non-public RegisterVirtualPathProviderInternal method, used reflection to modify BuildManager state, and hooked GetCacheKey() so ASP.NET would serve pages that do not exist as files. It activated only on requests carrying a specific User-Agent, and Kaspersky maps this trust-control subversion to T1553 (Kaspersky).

C2 and tunneling. Communication used a custom binary protocol with XOR obfuscation, plus TCP tunneling and the suo5 proxy tool to pivot through the SharePoint host into the internal network (Kaspersky; Cyber Security News).

Modules. The framework’s modules listed processes, logged-on users and network connections (FileDownloader, LoggedOnUsers, ProcessList, NetworkInfo), silently installed MSI packages, and created admin accounts via SAM RPC through samlib.dll (Kaspersky).

Privilege escalation. To reach SYSTEM, the actor used an EfsPotato-derived EFSRPC coercion with a malicious named pipe, ImpersonateNamedPipeClient and CreateProcessAsUser, abusing the SeImpersonatePrivilege held by the IIS worker process (Kaspersky; Cyber Security News).

Persistence via legitimate tooling. msiexec installed Velociraptor 0.73.4.0, a legitimate DFIR tool carrying known flaw CVE-2025-6264, from a Supabase-hosted MSI, then used it for persistence, discovery, collection and payload execution. Backup access routes included Zoho Assist, VS Code CLI tunneling, Cloudflare Tunnel and a lightweight reverse proxy, reducing dependence on the webshell and the ToolShell bug (Kaspersky; Cyber Security News).

Defense evasion and ransomware. A vulnerable driver, rsndispot.sys, was dropped to C:\programdata, paired with a sideloaded DLL identified as a Warlock antivirus killer (a renamed 7z.exe was used for sideloading). Warlock ransomware launch attempts were blocked by Kaspersky Endpoint Security’s Proactive Defense Module before any encryption occurred (Kaspersky; Cyber Security News).

Detection / what to do

• Patch and rotate. Install Microsoft’s SharePoint security updates and rotate exposed MachineKeys (Kaspersky; Cyber Security News).
• Hunt deserialization artifacts. Look for Microsoft.GeneratedCode and App_Web_toolpane.aspx* loading alongside ToolPane requests, and scan memory and assemblies for strings such as ObjectDataProvider, ExpandedWrapper and LosFormatter; Kaspersky released a CLRDeserializationExploitFinder tool (Kaspersky).
• Detect the VPP implant. Correlate IIS-Configuration ETW events 25 and 47 with the absence of events 17, 18, 19 and 21 for the same path, and maintain an allowlist of legitimate VirtualPathProvider implementations (Kaspersky).
• Watch runtime behaviour. Monitor for anomalous w3wp.exe activity, unexpected outbound connections, RPC coercion, token impersonation, and the sudden appearance of remote-management or DFIR tools; retain memory and IIS logs (Kaspersky; Cyber Security News).
• Respond as to a full compromise. Kaspersky advises “treating a confirmed exploit as a full host compromise”, contain the host, hunt persistence, rotate credentials, and investigate by TTP rather than IOC alone (Kaspersky).
• Selected IOCs. 45.91.94[.]204 and 49.51.132[.]100 (SPN nodes); 199.232.210[.]172 (C2 relay); 91.224.92[.]121 and 204.76.203[.]219 (bulletproof-hosted C2); the vskp2 webshell implant and the rsndispot.sys driver; Kaspersky detections Trojan.MSIL.Agent.gen and Trojan.Win64.DLLhijack.cdp. Verify any hash mappings against the primary report before acting (Kaspersky; Cyber Security News).

Sources

• Kaspersky Securelist: The SOC Files 5, Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603 (5 November 2026)
• Cyber Security News: Storm-2603 Hackers Exploit SharePoint ToolShell Flaws to Hide Fileless Backdoor and Launch Ransomware Attack (6 November 2026)