Storm-2603 Exploits SharePoint ToolShell Flaws and Cloudflare Tunnels
Original title: Storm-2603 Hackers Exploit SharePoint and Abuse Cloudflare Tunnel to Hide Remote Access
Storm-2603 installed webshells and deployed Cloudflare Tunnels after exploiting SharePoint vulnerabilities.
Storm-2603 exploited ToolShell flaws in on-premises SharePoint to install a memory-only webshell in w3wp.exe. The group later used Velociraptor to install additional tools and tunnels including Cloudflare Tunnel. Kaspersky assesses the attribution with moderate confidence.
Unconfirmed: Kaspersky assesses attribution with moderate confidence
- Attack occurred December 24 from IP 45.91.94.204
- Deployed Velociraptor version 0.73.4.0 vulnerable to CVE-2025-6264
- Used suo5 for bidirectional TCP tunnels
- Sideloaded Warlock AV killer
- Privilege escalation to SYSTEM via named-pipe impersonation
Impact: persistence via webshell and remote access tunnels
- 1.install SharePoint security updates
- 2.enable AMSI in Full Mode
- 3.hunt for Cloudflare Tunnel clients
- Threat actors
- Storm-2603
- Countries
- China
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-49704+1 related CVE | Authenticated Code Injection RCE in Microsoft SharePoint | 8.8 group max | 100% | KEVRansomware | KEV |
| CVE-2025-53770 | Unauthenticated Deserialization RCE in Microsoft SharePoint Server on-premises | 9.8 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2025-53771 | Improper Authentication in Microsoft SharePoint Server Enables Network Spoofing | 6.5 | 100% | ||
| CVE-2025-6264 | Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints | 5.5 | 1% | PoC ×2 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | v4.msi | edujhrzscjtq[.]supabase[.]co/storage/v1/object/public/image/v4[.]msi Vulnerable Velociraptor package 0x3A55D8F8F29716C69467183 |
| domain | vdfccjpnedujhrzscjtq.supabase.co | 1BF7FF7245DDA9B7B5D791ACE8 vskp2 – webshell implant hxxps://vdfccjpnedujhrzscjtq[.]supabase[.]co/storage/v1/object/public/image/v4[.]msi Vulnerable Velo |
| ipv4 | 45.91.94.204 | unnels on servers. IOCs Indicator of compromise Description 45.91.94[.]204 SPN node 0xFD91321BF7FF7245DDA9B7B5D791ACE8 vskp2 – websh |
| url | https://vdfccjpnedujhrzscjtq.supabase.co/storage/v1/object/public/image/v4.msi | 0xFD91321BF7FF7245DDA9B7B5D791ACE8 vskp2 – webshell implant hxxps://vdfccjpnedujhrzscjtq[.]supabase[.]co/storage/v1/object/public/image/v4[.]msi Vulnerable Velociraptor package 0x3A55D8F8F29716C6946 |
From the original article
3 min read at gbhackers.com
A December intrusion to Storm-2603, the China-based group Microsoft ties to Warlock ransomware. The attackers used ToolShell flaws in on-premises SharePoint and ran a memory-only webshell inside the IIS worker process. They then layered several tunnels, including Cloudflare Tunnel, to keep access after the initial foothold was gone.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.