A China-linked threat group tracked as Storm-2603 has used the SharePoint ToolShell flaws to plant a backdoor that never touches the disk.
The group then tried to run Warlock ransomware on the same network. The break-in hit an on-premises SharePoint server and ended with a ransomware launch that security software blocked.
ToolShell is the name for a set of Microsoft SharePoint bugs, including CVE-2025-53770 and CVE-2025-53771. They let an attacker run code on a server through specially crafted web requests.
Microsoft linked the ransomware side of this activity to Storm-2603, while other groups using the same flaws mostly stole data and spied. Defenders who thought July 2025 patching closed the story should note that unpatched servers were still being hit months later.
Researchers at Securelist, the threat research arm of Kaspersky, identified and documented this intrusion in a report published on November 5, 2026.
Their team found the activity in a December review of a customer’s logs. They noted that the attackers kept control inside the IIS worker process, w3wp.exe, and wrote nothing to disk for the backdoor itself. You can read the full Securelist analysis for the technical details.
The first sign was small. On December 20, a single request hit a SharePoint ToolPane endpoint to check whether the host was vulnerable to CVE-2025-53770. It came from infrastructure tied to ONYPHE, an internet scanning platform.
About 12 minutes later, a second connection arrived from a bulletproof hosting provider, Pfcloud UG. Nothing was exploited yet, and three quiet days followed.
Because of that gap, the team first rated the probe as low priority. The real intrusion came on December 24, Christmas Eve, when many security teams run with fewer staff.
Attack chain (Source – Securelist)
The attacker sent a crafted request from 45.91.94[.]204, a Safing Privacy Network node that hides the true source behind several relays.
That request loaded a webshell straight into the IIS worker process. It ran in memory and vanished if the application pool was recycled or IIS restarted. This matches what earlier reports on the ToolShell zero-day and Warlock ransomware warned about.
The webshell was a modular C# framework. Its main part, G.cs, registered a custom VirtualPathProvider, which lets ASP.NET serve pages that do not exist as files.
It woke up only when a request carried a specific User-Agent, so normal traffic never triggered it. It talked to the attacker over a custom binary protocol with simple XOR scrambling.
It also used the suo5 proxy tool to tunnel traffic through the SharePoint host, which let the attackers reach other machines inside the network.
Other modules listed running processes, logged-on users and network connections. One installed MSI packages silently, and another created admin accounts through low-level Windows account calls instead of normal commands.
For SYSTEM rights, the code used a named-pipe trick copied from the EfsPotato tool, which works because IIS worker processes hold the needed impersonation privilege.
Velociraptor, Tunnels and a Blocked Warlock Launch
Soon after the webshell ran, the worker process started msiexec.exe to install a package from Supabase cloud storage. The package was Velociraptor version 0.73.4.0, a real forensics tool with a known flaw, CVE-2025-6264.
Cisco Talos had already described Velociraptor abused in ransomware cases tied to the same group. Here, the attackers used it for persistence, discovery, data collection and running payloads.
Through Velociraptor, they set up several backup routes: Zoho Assist, VS Code tunneling, Cloudflare Tunnel and a small reverse proxy. With so many paths, deleting one tool would not end their access.
They also stopped depending on the webshell or the ToolShell bug at this point. The group then dropped a vulnerable driver, rsndispot.sys, to shut down endpoint protection.
Fingerprinting with ONYPHE (Source – Securelist)
A sideloaded DLL, flagged as Warlock’s antivirus killer, was likely meant to use it. This fits earlier findings on custom malware that abuses BYOVD from the same actor.
The final step failed. Kaspersky’s Proactive Defense Module blocked the Warlock ransomware process before it could encrypt anything.
Securelist assigns the case to Storm-2603 with moderate confidence, based on the ToolShell use, the Warlock tools and the Velociraptor habits.
For defenders, patching is not enough. Install Microsoft’s emergency SharePoint security updates, then rotate exposed MachineKeys and hunt for persistence.
Watch for odd w3wp.exe behavior, new VirtualPathProvider registrations, unexpected outbound connections and new remote-management tools. Securelist also advises keeping memory and IIS logs, and treating a confirmed exploit as a full host compromise.
Indicators of compromise (IoCs):-
IndicatorDescription45.91.94[.]204SPN node49.51.132[.]100SPN node199.232.210[.]172C2 traffic relay91.224.92[.]121Bulletproof-hosted C2 server204.76.203[.]219Bulletproof-hosted C2 server0xFD91321BF7FF7245DDA9B7B5D791ACE8vskp2 – webshell implant0x3A55D8F8F29716C694671834D8C6CB29C:\ProgramFiles\Velociraptor\Velociraptor.exe0x991EC6E04413F2D4D29341C17A8A54D5Abused legitimate VS Code0x3D553B9061C03F891CE97D7D2E64DDEEVS Code Insiders for tunneling0x2C32E44A013CBFC5A323EFB7694701D2Abused tunneling tool executable0x112A86ECA3CB5A0B5E20AB744CC5AF937z.exe renamed for sideloading0xA930F81E3FB0A226EC5904D9043A17B8C:\ProgramFiles(x86)\ZohoMeeting\UnAttended\ZohoMeeting.7z0x054a32d6033b1744dca7f49b2e466ea2Vulnerable driver (rsndispot.sys)2d9ebf9c042f596f435865b40edad928Malicious DLL, Warlock ransomware AV killer (named in report text)hxxps://vdfccjpnedujhrzscjtq[.]supabase[.]co/storage/v1/object/public/image/v4[.]msiVulnerable Velociraptor packagehxxps://auth[.]qgtxtebl[.]workers[.]dev/Velociraptor server URLhxxps://github[.]com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64[.]msiAbused legitimate tunneling toolhxxps://files[.]catbox[.]moe/8f7vex[.]msiAbused Zoho Assist Unattended Agent download URLTrojan.MSIL.Agent.gen, Trojan.Win64.DLLhijack.cdpKaspersky detection names
Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
Click Here For The Original Source.
——————————————————–
