Storm-2603 exploits ToolShell SharePoint flaws (CVE-2025-53770/53771) for fileless IIS webshell and blocked Warlock ransomware attempt
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 06/11/2026 04:02; os links antigos trazem para cá.
Fontes: gbhackers.com ↗ securelist.com ↗
Kaspersky published a retrospective analysis (securelist.com) of a December intrusion by Storm-2603, which exploited the ToolShell on-premises SharePoint flaws CVE-2025-53770 and CVE-2025-53771. The attack began with a fingerprinting probe from ONYPHE infrastructure on December 20. After roughly three days of latency, full exploitation came on December 24 from an IP associated with Safing Privacy Network (SPN) (securelist.com). The actor ran a fileless, multi-module in-memory webshell inside the IIS worker process (w3wp.exe), and later abused Cloudflare Tunnel to hide remote access (gbhackers.com). The attempt to deploy Warlock ransomware was blocked by Kaspersky Endpoint Security (securelist.com). Kaspersky attributes the activity to Storm-2603 with moderate confidence, based on TTP overlap with Microsoft's earlier reporting.
Entenda a falha
A vulnerabilidade
CVE-2025-53770 and CVE-2025-53771, known as ToolShell, are flaws in on-premises Microsoft SharePoint. Per Kaspersky, crafted HTTP requests to an administrative endpoint of the ToolPane component give remote code execution inside the IIS worker process w3wp.exe. gbhackers says the chain bypasses the earlier fixes for CVE-2025-49704 and CVE-2025-49706, which are only context here. The articles give no authentication requirement and no affected or fixed versions; the advice is to install the SharePoint security updates. CVE-2025-6264 affects Velociraptor: Storm-2603 deployed v0.73.4.0, which gbhackers calls vulnerable, as a post-exploitation tool. The articles give no impact or fixed version for it.
Como funciona
A crafted HTTP request reaches the SharePoint ToolPane administrative endpoint and is handled by the ASP.NET pipeline in w3wp.exe. The endpoint can handle serialized input, and the request is processed without rejection. Exploitation ends in code execution in the worker process. In this incident the actor loaded a webshell straight into the ASP.NET runtime without writing it to disk and registered a custom VirtualPathProvider, hooking GetCacheKey() so it can inspect every later request. The implant stays dormant unless the request carries a specific User-Agent. It lasts until the application pool is recycled or IIS is restarted.
Por que é vulnerável
The articles describe the root cause only indirectly: the ToolPane path accepts serialized input and the exploitation leaves CLR gadget-chain traces such as ObjectDataProvider, ExpandedWrapper and LosFormatter strings, which points to unsafe deserialization. gbhackers adds that the chain bypasses earlier fixes for CVE-2025-49704 and CVE-2025-49706, so those patches were incomplete. The articles do not explain what the new patch changes, and say nothing about the root cause of CVE-2025-6264. Microsoft's mitigation also includes AMSI in Full Mode and rotating ASP.NET machine keys.
Onde está
The articles point only to the SharePoint ToolPane administrative endpoint and the w3wp.exe worker process, with artifacts such as App_Web_toolpane.aspx* and Microsoft.GeneratedCode. They name no vulnerable source file, function or fixing commit.
Como foi descoberta
The incident came to light through Kaspersky's retrospective analysis, not as a new flaw discovery. On December 20 an ONYPHE probe checked whether the host was vulnerable to CVE-2025-53770. Full exploitation followed on December 24 from a Safing Privacy Network node, and the incident was discovered on December 26. The three-day gap kept the probe from being correlated with the attack, so it was first treated as low priority. Microsoft had already tied ransomware-related ToolShell activity to Storm-2603, and Kaspersky attributes this intrusion to the group with moderate confidence, based on TTP overlap. Kaspersky Endpoint Security blocked the Warlock ransomware launch.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
The articles show working exploitation in the wild by Storm-2603, which ran the full remote code execution chain and a multi-module in-memory webshell. No published copy of that exploit is mentioned, so it counts as private. The ONYPHE checker is a non-intrusive probe that injects a harmless marker, following an approach by Niels Hofmans (hazcod), and it only tests for vulnerability. Because the flaw is actively exploited, including by ransomware actors, patching SharePoint is urgent. Patching alone is not enough: the actor also left independent remote access through Cloudflare Tunnel, Zoho Assist and VS Code tunnels.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 04:18.
Exploit público
Há código de exploração publicado no Exploit-DB para CVE-2025-53770. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
Microsoft SharePoint Server 2019 (16.0.10383.20020) - Remote Code Execution (RCE)
This script targets the ToolPane page of on-premises SharePoint Server 2019 (CVE-2025-53770, unsafe deserialization known as ToolShell). It needs only network access to the web front end and no login, since it fakes a sign-out referrer to skip authentication. It submits a crafted web part with an ExcelDataSet control, then only reads the reply, decodes a returned data blob and looks for keywords. It runs no commands and drops no web shell, so it is a rough exposure check, not the working RCE its title claims.
Detalhes técnicos
- Webshell: the core module G.cs registers a custom VirtualPathProvider by subverting trust controls through reflection (T1553). It implements an XOR-obfuscated binary C2 protocol over HTTP, triggered by a specific User-Agent, and opens full-duplex TCP tunnels for lateral pivoting using suo5 (securelist.com).
- Modules: Prog.cs is the entry point and dispatches commands to uk/London.cs. That module escalates privileges through an EFSRPC token-impersonation technique adapted from EfsPotato (EfsrTiny), coercing LSASS.exe to reach SYSTEM. FileDownloader.cs and the SAMRPCNative namespace handle file downloads, MSI installs and stealthy admin account creation via SAM RPC (securelist.com).
- Disk artifacts: the access and control layer avoided disk writes, but post-exploitation did not. The actor dropped a vulnerable driver (rsndispot.sys, hash 054a32d6033b1744dca7f49b2e466ea2) as an EDR killer. It also dropped a malicious DLL, the Warlock AV-killer (hash 2d9ebf9c042f596f435865b40edad928) (securelist.com).
- Persistence and tooling: the actor deployed Velociraptor v0.73.4.0, which is vulnerable to CVE-2025-6264, downloaded from Supabase storage. It also used Zoho Assist Unattended Support, VS Code CLI tunneling and Cloudflare Tunnel for redundant access (securelist.com).
- Detection: look for CLR deserialization artifacts such as Microsoft.GeneratedCode, App_Web_toolpane.aspx*, and ObjectDataProvider, ExpandedWrapper and LosFormatter strings. ETW-based VirtualPathProvider anomaly detection is also possible: IIS-Configuration events 25/47 appear without the expected FileChangeNotificationMonitor events 17/18/19/21 (securelist.com).
Remediação
- Kaspersky released a free tool, CLRDeserializationExploitFinder, to detect ToolShell and other ysoserial.net/YSoNet gadget-chain deserialization exploitation. It also released the VirtualPathProvider Lab project for understanding and hunting fileless VPP-based implants (securelist.com).
- Patch SharePoint against CVE-2025-53770 (securelist.com; the source text is truncated at this point, so further guidance is not available).
- Hunt for the indicators above, including the vulnerable driver, the Velociraptor version and unauthorized tunneling tools.
Relatos divergentes
The sources do not conflict on facts, but they differ in how firmly they attribute the activity. securelist.com, the original and more authoritative research, attributes it to Storm-2603 with moderate confidence. gbhackers.com states the link more flatly, describing Storm-2603 as the China-based group Microsoft ties to Warlock ransomware. Treat the securelist.com confidence level as the reference.
Linha do tempo
-
Storm-2603 Hackers Exploit SharePoint and Abuse Cloudflare Tunnel to Hide Remote Access
ler a análise desta fonte ocultar
A December intrusion to Storm-2603, the China-based group Microsoft ties to Warlock ransomware.
The attackers used ToolShell flaws in on-premises SharePoint and ran a memory-only webshell inside the IIS worker process.
-
Storm-2603 Exploits ToolShell SharePoint Flaws for Fileless Webshell, Attempts Warlock Ransomware Deployment
ler a análise desta fonte ocultar
Kaspersky (Securelist) published a detailed retrospective analysis of a Storm-2603 intrusion exploiting the ToolShell SharePoint vulnerabilities CVE-2025-53770 and CVE-2025-53771. The attack began with a vulnerability fingerprinting probe from ONYPHE infrastructure on December 20, followed by a three-day latency period and full exploitation on December 24 (Christmas Eve) from an IP associated with Safing Privacy Network (SPN). The actor deployed a fileless, multi-module in-memory webshell within the IIS worker process (w3wp.exe) using a custom VirtualPathProvider, avoiding disk writes for the access/control layer, though post-exploitation activity generated disk artifacts including a vulnerable driver EDR killer and a Warlock ransomware AV-killer DLL. The ransomware deployment attempt was blocked by Kaspersky Endpoint Security. Attribution to Storm-2603 is made with moderate confidence based on TTP overlap with Microsoft's prior reporting, including use of Velociraptor (vulnerable version exploitable via CVE-2025-6264) and multiple tunneling tools.
Technical Details
The webshell's core module G.cs registers a custom VirtualPathProvider via reflection-based trust-control subversion (T1553), implements a custom XOR-obfuscated binary C2 protocol over HTTP using a specific User-Agent trigger, and establishes full-duplex TCP tunnels for lateral pivoting (leveraging the suo5 proxying tool). Prog.cs serves as the entry point dispatching commands to uk/London.cs, which handles privilege escalation via an EFSRPC-based local token impersonation technique adapted from EfsPotato (EfsrTiny), achieving SYSTEM privileges through LSASS.exe coercion. Additional modules (FileDownloader.cs, SAMRPCNative namespace) enable arbitrary file downloads, MSI installs, and stealthy admin account creation via SAM RPC. Post-exploitation, the actor deployed Velociraptor v0.73.4.0 (vulnerable to CVE-2025-6264) from Supabase storage, plus Zoho Assist-Unattended Support, VS Code CLI tunneling, and Cloudflare Tunnel for redundant persistence. A vulnerable driver (rsndispot.sys, hash 054a32d6033b1744dca7f49b2e466ea2) and a malicious DLL (2d9ebf9c042f596f435865b40edad928, Warlock AV-killer) were used to attempt EDR termination before the ransomware launch was blocked. Detection guidance centers on CLR deserialization artifacts (Microsoft.GeneratedCode, App_Web_toolpane.aspx*, ObjectDataProvider/ExpandedWrapper/LosFormatter strings) and ETW-based VirtualPathProvider anomaly detection (IIS-Configuration events 25/47 vs missing FileChangeNotificationMonitor events 17/18/19/21).
Remediation
Kaspersky released a free tool, CLRDeserializationExploitFinder, to detect ToolShell and other ysoserial.net/YSoNet gadget-chain deserialization exploitation, plus a VirtualPathProvider Lab project for understanding and hunting fileless VPP-based implants. Defenders should patch SharePoint against CVE-2025-53770/53771, inventory legitimate VirtualPathProvider implementations, monitor w3wp.exe memory for anomalous assemblies, and treat unexpected administrative account creation via SAM RPC as a high-fidelity indicator.