Storm-2603 used SharePoint ToolShell flaws for a fileless backdoor
Original title: Storm-2603 Hackers Exploit SharePoint ToolShell Flaws to Hide Fileless Backdoor and Launch Ransomware Attack
Kaspersky says the group hit an on-premises server on December 24 and its product blocked Warlock before encryption.
Securelist says China-linked Storm-2603 exploited SharePoint ToolShell bugs, including CVE-2025-53770 and CVE-2025-53771, to load an in-memory webshell inside w3wp.exe on a customer’s on-premises server. After a December 20 probe, the intrusion began on December 24 from a Safing Privacy Network node. The attackers installed Velociraptor 0.73.4.0, added remote-access tunnels, and tried to disable endpoint protection before launching Warlock. Kaspersky’s Proactive Defense Module blocked the ransomware process.
Unconfirmed: Securelist assigns the intrusion to Storm-2603 only with moderate confidence.
- Securelist published the case on November 5, 2026, from a December log review.
- The webshell woke only on a specific User-Agent and used XOR and the suo5 proxy.
- Velociraptor 0.73.4.0 was pulled from Supabase and has known flaw CVE-2025-6264.
- A vulnerable driver, rsndispot.sys, was used in an attempt to kill endpoint protection.
- Attribution to Storm-2603 is moderate confidence, based on tools and ToolShell use.
Impact: In-memory SharePoint control and a blocked ransomware launch
| Product | Affected |
|---|---|
| Microsoft SharePoint | on-premises servers vulnerable to ToolShell |
| Velociraptor | 0.73.4.0 |
- 1.Install Microsoft’s emergency SharePoint security updates and rotate exposed MachineKeys.
- 2.Hunt for odd w3wp.exe behavior, VirtualPathProvider registrations, and unexpected remote-management tools.
- 3.Keep memory and IIS logs and treat a confirmed exploit as full host compromise.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1068 Exploitation for Privilege EscalationT1562.001 Disable or Modify ToolsT1090 Proxy
- Vendors
- Microsoft
- Products
- SharePointVelociraptor
- Threat actors
- Storm-2603
- Malware
- Warlock
- Organizations
- KasperskySecurelistCisco Talos
- Countries
- China
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-53770 | Unauthenticated Deserialization RCE in Microsoft SharePoint Server on-premises | 9.8 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2025-53771 | Improper Authentication in Microsoft SharePoint Server Enables Network Spoofing | 6.5 | 100% | ||
| CVE-2025-6264 | Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints | 5.5 | 1% | PoC ×2 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 8f7vex.msi | used legitimate tunneling tool hxxps://files[.]catbox[.]moe/8f7vex[.]msi Abused Zoho Assist Unattended Agent download URL Trojan.M |
| domain | auth.qgtxtebl.workers.dev | blic/image/v4[.]msi Vulnerable Velociraptor package hxxps://auth[.]qgtxtebl[.]workers[.]dev/ Velociraptor server URL hxxps://github[.]com/cloudfl |
| domain | cloudflared-windows-amd64.msi | ithub[.]com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64[.]msi Abused legitimate tunneling tool hxxps://files[.]catbox[. |
| domain | files.catbox.moe | indows-amd64[.]msi Abused legitimate tunneling tool hxxps://files[.]catbox[.]moe/8f7vex[.]msi Abused Zoho Assist Unattended Agent downlo |
| domain | v4.msi | edujhrzscjtq[.]supabase[.]co/storage/v1/object/public/image/v4[.]msi Vulnerable Velociraptor package hxxps://auth[.]qgtxtebl[. |
| domain | vdfccjpnedujhrzscjtq.supabase.co | Warlock ransomware AV killer (named in report text) hxxps://vdfccjpnedujhrzscjtq[.]supabase[.]co/storage/v1/object/public/image/v4[.]msi Vulnerable Velo |
| ipv4 | 199.232.210.172 | escription 45.91.94[.]204 SPN node 49.51.132[.]100 SPN node 199.232.210[.]172 C2 traffic relay 91.224.92[.]121 Bulletproof-hosted C2 se |
| ipv4 | 204.76.203.219 | traffic relay 91.224.92[.]121 Bulletproof-hosted C2 server 204.76.203[.]219 Bulletproof-hosted C2 server 0xFD91321BF7FF7245DDA9B7B5D7 |
| ipv4 | 45.91.94.204 | urce – Securelist) The attacker sent a crafted request from 45.91.94[.]204, a Safing Privacy Network node that hides the true source |
| ipv4 | 49.51.132.100 | mise (IoCs):- Indicator Description 45.91.94[.]204 SPN node 49.51.132[.]100 SPN node 199.232.210[.]172 C2 traffic relay 91.224.92[.]1 |
| ipv4 | 91.224.92.121 | 49.51.132[.]100 SPN node 199.232.210[.]172 C2 traffic relay 91.224.92[.]121 Bulletproof-hosted C2 server 204.76.203[.]219 Bulletproof |
| md5 | 2d9ebf9c042f596f435865b40edad928 | 6033b1744dca7f49b2e466ea2 Vulnerable driver (rsndispot.sys) 2d9ebf9c042f596f435865b40edad928 Malicious DLL, Warlock ransomware AV killer (named in repor |
| url | https://auth.qgtxtebl.workers.dev/ | bject/public/image/v4[.]msi Vulnerable Velociraptor package hxxps://auth[.]qgtxtebl[.]workers[.]dev/ Velociraptor server URL hxxps://github[.]com/cloudfla |
| url | https://files.catbox.moe/8f7vex.msi | flared-windows-amd64[.]msi Abused legitimate tunneling tool hxxps://files[.]catbox[.]moe/8f7vex[.]msi Abused Zoho Assist Unattended Agent download URL Troj |
| url | https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.msi | ://auth[.]qgtxtebl[.]workers[.]dev/ Velociraptor server URL hxxps://github[.]com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64[.]msi Abused legitimate tunneling tool hxxps://files[.]catbox |
| url | https://vdfccjpnedujhrzscjtq.supabase.co/storage/v1/object/public/image/v4.msi | us DLL, Warlock ransomware AV killer (named in report text) hxxps://vdfccjpnedujhrzscjtq[.]supabase[.]co/storage/v1/object/public/image/v4[.]msi Vulnerable Velociraptor package hxxps://auth[.]qgtxte |
From the original article
4 min read at cybersecuritynews.com
A China-linked threat group tracked as Storm-2603 has used the SharePoint ToolShell flaws to plant a backdoor that never touches the disk. The group then tried to run Warlock ransomware on the same network. The break-in hit an on-premises SharePoint server and ended with a ransomware launch that security software blocked.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.