Storm-2603 Exploits ToolShell SharePoint Flaws for Fileless Webshell, Attempts Warlock Ransomware Deployment
Kaspersky (Securelist) published a detailed retrospective analysis of a Storm-2603 intrusion exploiting the ToolShell SharePoint vulnerabilities CVE-2025-53770 and CVE-2025-53771. The attack began with a vulnerability fingerprinting probe from ONYPHE infrastructure on December 20, followed by a three-day latency period and full exploitation on December 24 (Christmas Eve) from an IP associated with Safing Privacy Network (SPN). The actor deployed a fileless, multi-module in-memory webshell within the IIS worker process (w3wp.exe) using a custom VirtualPathProvider, avoiding disk writes for the access/control layer, though post-exploitation activity generated disk artifacts including a vulnerable driver EDR killer and a Warlock ransomware AV-killer DLL. The ransomware deployment attempt was blocked by Kaspersky Endpoint Security. Attribution to Storm-2603 is made with moderate confidence based on TTP overlap with Microsoft's prior reporting, including use of Velociraptor (vulnerable version exploitable via CVE-2025-6264) and multiple tunneling tools.
Entenda a falha
A vulnerabilidade
CVE-2025-53770 and CVE-2025-53771, together called ToolShell, are flaws in on-premises Microsoft SharePoint. Per Kaspersky, attackers use crafted HTTP requests to a ToolPane-related administrative endpoint to get remote code execution inside the IIS worker process w3wp.exe, and the CLR deserialization artifacts point to unsafe deserialization. The articles do not give authentication requirements or affected and fixed versions, only that defenders should patch SharePoint. CVE-2025-6264 is a flaw in Velociraptor. Storm-2603 deployed v0.73.4.0, which Kaspersky describes as vulnerable, as a post-exploitation tool. The articles give no detail on that flaw's impact or fixed version.
Como funciona
A crafted HTTP request reaches the SharePoint ToolPane administrative endpoint and is handled by the ASP.NET pipeline in w3wp.exe. The request carries serialized input that the application processes, and the deserialization step ends in code execution in the worker process. In this incident the actor loaded a webshell straight into the ASP.NET runtime without writing it to disk, and it registered a custom VirtualPathProvider so later requests are intercepted. The implant stays dormant unless a request has a specific User-Agent. It lasts until the application pool is recycled or IIS is restarted.
Por que é vulnerável
The articles describe the root cause only indirectly: the SharePoint ToolPane path accepts serialized input and deserializes it, and the exploitation leaves typical CLR gadget-chain traces such as ObjectDataProvider, ExpandedWrapper and LosFormatter strings. The fix is a SharePoint patch for both CVEs. The articles do not explain what the patch changes. Nothing is said about the root cause of CVE-2025-6264. The ONYPHE probe passed without any defensive control interrupting it.
Onde está
The articles point only to the SharePoint ToolPane administrative endpoint and the w3wp.exe worker process, with artifacts such as App_Web_toolpane.aspx* and Microsoft.GeneratedCode. They name no vulnerable source file, function or fixing commit.
Como foi descoberta
This incident was found through Kaspersky's retrospective analysis, not as a new flaw discovery. On December 20 an ONYPHE probe checked whether the host was vulnerable to CVE-2025-53770, and full exploitation followed on December 24 from a Safing Privacy Network node. The incident was discovered on December 26. The three-day gap meant the probe was first not correlated with the attack and was treated as low priority. Microsoft had already attributed ransomware-related ToolShell activity to Storm-2603. Kaspersky attributes this intrusion to the group with moderate confidence, based on TTP overlap.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
The articles show working exploitation in the wild by Storm-2603, which executed the full remote code execution chain and ran a multi-module in-memory webshell. They point to no published copy of that exploit. The ONYPHE checker mentioned is a non-intrusive probe that injects a harmless marker, following an approach by Niels Hofmans (hazcod), and it only tests for vulnerability. Because the flaw is actively exploited, including by ransomware actors, patching SharePoint is urgent.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 08:19.
Exploit público
Há código de exploração publicado no Exploit-DB para CVE-2025-53770. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
Microsoft SharePoint Server 2019 (16.0.10383.20020) - Remote Code Execution (RCE)
This script targets the ToolPane page of on-premises SharePoint Server 2019 (CVE-2025-53770, unsafe deserialization known as ToolShell). It needs only network access to the web front end and no login, since it fakes a sign-out referrer to skip authentication. It submits a crafted web part with an ExcelDataSet control, then only reads the reply, decodes a returned data blob and looks for keywords. It runs no commands and drops no web shell, so it is a rough exposure check, not the working RCE its title claims.
Detalhes técnicos
The webshell's core module G.cs registers a custom VirtualPathProvider via reflection-based trust-control subversion (T1553), implements a custom XOR-obfuscated binary C2 protocol over HTTP using a specific User-Agent trigger, and establishes full-duplex TCP tunnels for lateral pivoting (leveraging the suo5 proxying tool). Prog.cs serves as the entry point dispatching commands to uk/London.cs, which handles privilege escalation via an EFSRPC-based local token impersonation technique adapted from EfsPotato (EfsrTiny), achieving SYSTEM privileges through LSASS.exe coercion. Additional modules (FileDownloader.cs, SAMRPCNative namespace) enable arbitrary file downloads, MSI installs, and stealthy admin account creation via SAM RPC. Post-exploitation, the actor deployed Velociraptor v0.73.4.0 (vulnerable to CVE-2025-6264) from Supabase storage, plus Zoho Assist-Unattended Support, VS Code CLI tunneling, and Cloudflare Tunnel for redundant persistence. A vulnerable driver (rsndispot.sys, hash 054a32d6033b1744dca7f49b2e466ea2) and a malicious DLL (2d9ebf9c042f596f435865b40edad928, Warlock AV-killer) were used to attempt EDR termination before the ransomware launch was blocked. Detection guidance centers on CLR deserialization artifacts (Microsoft.GeneratedCode, App_Web_toolpane.aspx*, ObjectDataProvider/ExpandedWrapper/LosFormatter strings) and ETW-based VirtualPathProvider anomaly detection (IIS-Configuration events 25/47 vs missing FileChangeNotificationMonitor events 17/18/19/21).
Remediação
Kaspersky released a free tool, CLRDeserializationExploitFinder, to detect ToolShell and other ysoserial.net/YSoNet gadget-chain deserialization exploitation, plus a VirtualPathProvider Lab project for understanding and hunting fileless VPP-based implants. Defenders should patch SharePoint against CVE-2025-53770/53771, inventory legitimate VirtualPathProvider implementations, monitor w3wp.exe memory for anomalous assemblies, and treat unexpected administrative account creation via SAM RPC as a high-fidelity indicator.
Linha do tempo
-
Storm-2603 Exploits ToolShell SharePoint Flaws for Fileless Webshell, Attempts Warlock Ransomware Deployment
ler a análise desta fonte ocultar
Kaspersky (Securelist) published a detailed retrospective analysis of a Storm-2603 intrusion exploiting the ToolShell SharePoint vulnerabilities CVE-2025-53770 and CVE-2025-53771. The attack began with a vulnerability fingerprinting probe from ONYPHE infrastructure on December 20, followed by a three-day latency period and full exploitation on December 24 (Christmas Eve) from an IP associated with Safing Privacy Network (SPN). The actor deployed a fileless, multi-module in-memory webshell within the IIS worker process (w3wp.exe) using a custom VirtualPathProvider, avoiding disk writes for the access/control layer, though post-exploitation activity generated disk artifacts including a vulnerable driver EDR killer and a Warlock ransomware AV-killer DLL. The ransomware deployment attempt was blocked by Kaspersky Endpoint Security. Attribution to Storm-2603 is made with moderate confidence based on TTP overlap with Microsoft's prior reporting, including use of Velociraptor (vulnerable version exploitable via CVE-2025-6264) and multiple tunneling tools.
Technical Details
The webshell's core module G.cs registers a custom VirtualPathProvider via reflection-based trust-control subversion (T1553), implements a custom XOR-obfuscated binary C2 protocol over HTTP using a specific User-Agent trigger, and establishes full-duplex TCP tunnels for lateral pivoting (leveraging the suo5 proxying tool). Prog.cs serves as the entry point dispatching commands to uk/London.cs, which handles privilege escalation via an EFSRPC-based local token impersonation technique adapted from EfsPotato (EfsrTiny), achieving SYSTEM privileges through LSASS.exe coercion. Additional modules (FileDownloader.cs, SAMRPCNative namespace) enable arbitrary file downloads, MSI installs, and stealthy admin account creation via SAM RPC. Post-exploitation, the actor deployed Velociraptor v0.73.4.0 (vulnerable to CVE-2025-6264) from Supabase storage, plus Zoho Assist-Unattended Support, VS Code CLI tunneling, and Cloudflare Tunnel for redundant persistence. A vulnerable driver (rsndispot.sys, hash 054a32d6033b1744dca7f49b2e466ea2) and a malicious DLL (2d9ebf9c042f596f435865b40edad928, Warlock AV-killer) were used to attempt EDR termination before the ransomware launch was blocked. Detection guidance centers on CLR deserialization artifacts (Microsoft.GeneratedCode, App_Web_toolpane.aspx*, ObjectDataProvider/ExpandedWrapper/LosFormatter strings) and ETW-based VirtualPathProvider anomaly detection (IIS-Configuration events 25/47 vs missing FileChangeNotificationMonitor events 17/18/19/21).
Remediation
Kaspersky released a free tool, CLRDeserializationExploitFinder, to detect ToolShell and other ysoserial.net/YSoNet gadget-chain deserialization exploitation, plus a VirtualPathProvider Lab project for understanding and hunting fileless VPP-based implants. Defenders should patch SharePoint against CVE-2025-53770/53771, inventory legitimate VirtualPathProvider implementations, monitor w3wp.exe memory for anomalous assemblies, and treat unexpected administrative account creation via SAM RPC as a high-fidelity indicator.