Storm-2603 Fileless ToolShell Breach of On-Prem SharePoint (CVE-2025-53770 / CVE-2025-53771) with Warlock/LockBit Ransomware

Key facts for Storm-2603 SharePoint ToolShell

Detection coverage for Storm-2603 SharePoint ToolShell

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5315 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: IIS w3wp.exe Spawning Shells, Discovery Tools and Account Creation (ToolShell Post-Exploitation)

Detects the SharePoint application pool worker w3wp.exe spawning command interpreters, discovery utilities (whoami, tasklist, netstat, ipconfig, nltest), net user/localgroup account creation or msiexec. This is how the Storm-2603 in-memory C# webshell framework (ProcessList, LoggedOnUsers, NetworkInfo, MSI and User modules) shows up in process telemetry. Children running as SYSTEM point to EfsPotato-style token impersonation.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1505.003, T1033, T1057, T1049, T1136.001, T1218.007, T1134.001
• Data sources: sysmon_event_id_1, microsoft_defender_DeviceProcessEvents, windows_security_4688
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| where match(ParentImage,"(?i)w3wp[.]exe$")
| where match(Image,"(?i)(cmd|powershell|pwsh|whoami|tasklist|netstat|ipconfig|net|net1|msiexec|certutil|bitsadmin|curl|wmic|nltest|systeminfo|quser)[.]exe$")
| eval is_system=if(match(User,"(?i)SYSTEM$"),1,0)
| eval tradecraft=case(match(CommandLine,"(?i)net1?([.]exe)?.{0,2}[ ]+(user|localgroup)[ ]+.*(/add|administrators)"),"T1136.001_local_account_creation", match(Image,"(?i)msiexec[.]exe$"),"T1218.007_msi_install", match(Image,"(?i)(whoami|quser)[.]exe$"),"T1033_user_discovery", match(Image,"(?i)tasklist[.]exe$"),"T1057_process_discovery", match(Image,"(?i)(netstat|ipconfig|nltest)[.]exe$"),"T1049_network_discovery", true(),"w3wp_child_shell")
| stats count min(_time) as first_seen max(_time) as last_seen values(tradecraft) as tradecraft values(Image) as child_images values(CommandLine) as command_lines max(is_system) as ran_as_system by host ParentCommandLine User
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ 'w3wp.exe'
| where FileName in~ ('cmd.exe', 'powershell.exe', 'pwsh.exe', 'whoami.exe', 'tasklist.exe', 'netstat.exe', 'ipconfig.exe', 'net.exe', 'net1.exe', 'msiexec.exe', 'certutil.exe', 'bitsadmin.exe', 'curl.exe', 'wmic.exe', 'nltest.exe', 'systeminfo.exe', 'quser.exe')
| extend Tradecraft = case(
    FileName in~ ('net.exe', 'net1.exe') and ProcessCommandLine matches regex @'(?i)(user|localgroup)[ ]+.*(/add|administrators)', 'T1136.001_local_account_creation',
    FileName =~ 'msiexec.exe', 'T1218.007_msi_install',
    FileName in~ ('whoami.exe', 'quser.exe'), 'T1033_user_discovery',
    FileName =~ 'tasklist.exe', 'T1057_process_discovery',
    FileName in~ ('netstat.exe', 'ipconfig.exe', 'nltest.exe'), 'T1049_network_discovery',
    'w3wp_child_shell'),
  RanAsSystem = toint(AccountName =~ 'system')
| summarize Events = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Tradecraft = make_set(Tradecraft), CommandLines = make_set(ProcessCommandLine, 10), RanAsSystem = max(RanAsSystem) by DeviceName, InitiatingProcessCommandLine, AccountName
| order by LastSeen desc

Sigma

title: IIS Worker Process w3wp Spawning Shell or Discovery Utility
id: b7e40d93-2a6c-4c18-8e5f-1d9a3b6c7f22
status: experimental
description: Detects w3wp.exe spawning command interpreters, discovery tools, net user/localgroup or msiexec. Consistent with the Storm-2603 fileless C# webshell framework running inside the SharePoint worker process after ToolShell exploitation.
references:
  - https://securelist.com/storm-2603-fileless-toolshell-attack/121467/
  - https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.discovery
  - attack.t1033
  - attack.t1057
  - attack.t1049
  - attack.t1136.001
  - attack.defense-evasion
  - attack.t1218.007
  - attack.privilege-escalation
  - attack.t1134.001
  - cve.2025-53770
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\whoami.exe'
      - '\tasklist.exe'
      - '\netstat.exe'
      - '\ipconfig.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\msiexec.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wmic.exe'
      - '\nltest.exe'
      - '\systeminfo.exe'
      - '\quser.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Custom IIS applications that legitimately shell out to cmd.exe or powershell.exe
  - Health-check or diagnostic scripts launched by the application pool
level: high

Known false positives:

• Custom IIS web applications that legitimately shell out to cmd.exe or powershell.exe
• SharePoint health-analyzer or diagnostic scripts launched under the application pool identity

Tuning notes: Scope to SharePoint web front-end and application servers. Baseline legitimate w3wp children for 7-14 days and exclude by exact CommandLine. ran_as_system=1 on a w3wp child is a strong escalation signal (EfsPotato-style token impersonation) and should page the on-call analyst. SharePoint legitimately spawns csc.exe for ASP.NET compilation, so csc.exe is deliberately not in the child list.

• 🔒 SharePoint w3wp.exe In-Memory .NET Module and ASPX Drop (Fileless Webshell / MachineKey Theft) · unlock with TL Creds
• 🔒 Local Administrator Account Created by Machine/SYSTEM Context (ToolShell User Module Persistence) · unlock with TL Creds
• 🔒 Storm-2603 C2 Infrastructure and Tunnel Egress (cloudflared, VS Code Tunnel, Velociraptor, w3wp Public Egress) · unlock with TL Creds
• 🔒 SharePoint spinstall0.aspx MachineKey-Theft Webshell Access and ToolShell Source IPs · unlock with TL Creds
• 🔒 BYOVD EDR Killer rsndispot.sys and Warlock AV-Killer DLL Staging · unlock with TL Creds
• 🔒 Storm-2603 C2 and Tunnel Domain DNS Lookups (updatemicfosoft, ngrok, workers.dev, argotunnel, devtunnels) · unlock with TL Creds
• 🔒 SharePoint ToolShell ToolPane.aspx Exploitation (CVE-2025-53770 / CVE-2025-53771) - Exploitation Phase · unlock with TL Creds
• 🔒 Abused Remote Access Tooling Install - Velociraptor, Zoho Assist, VS Code Tunnel, cloudflared, Remote MSI · unlock with TL Creds

Indicators of compromise for Storm-2603 SharePoint ToolShell

As of 2026-11-05, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-5315.

Sample indicators (3 of 30)

• IP address: 45.91.94[.]204
• Domain: update[.]updatemicfosoft[.]com
• URL: hxxps://vdfccjpnedujhrzscjtq[.]supabase[.]co/storage/v1/object/public/image/v4.msi

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

Community OSINT corroboration for Storm-2603 SharePoint ToolShell

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How Storm-2603 SharePoint ToolShell works

In the incident Kaspersky analyzed, the attacker first fingerprinted the SharePoint ToolPane endpoint (observed via ONYPHE, Dec 20), went quiet for three days (Dec 21-23), then executed a full remote-code-execution chain on Dec 24 through the IIS worker process w3wp.exe. The chain abuses the ToolShell deserialization/authentication-bypass flaws (CVE-2025-53770, with CVE-2025-53771 as the related spoofing/path-traversal bypass). Kaspersky found the incident on Dec 26 during retrospective analysis. The source does not state the year; this record uses 2025 for those dates.

The implant was fileless. Control stayed inside w3wp.exe, with no webshell written to disk. It was a multi-module C# framework: G.cs (pipeline control, session management and a custom binary C2 protocol with XOR obfuscation), Prog.cs (entry point and task dispatcher), FileDownloader.cs, LoggedOnUsers.cs, ProcessList.cs, NetworkInfo.cs, MSI.cs (silent MSI install), User.cs (creates administrative accounts through SAM RPC via a samlib.dll P/Invoke wrapper) and London.cs (command orchestrator with EFSRPC/EfsPotato-style token-impersonation privilege escalation). Persistence relied on VirtualPathProvider registration, so the content exists only in memory with no matching file on disk.

For follow-on tooling the attacker used a Velociraptor 0.73.4.0 MSI pulled from a Supabase storage URL and pointed at a workers.dev server. Velociraptor 0.73.4.0 is affected by CVE-2025-6264 (fixed in 0.74.3). The attacker also installed Zoho Assist Unattended Agent from a catbox.moe-hosted MSI, used VS Code CLI tunneling, Cloudflare Tunnel (cloudflared) and the suo5 reverse proxy for persistent encrypted access, and sideloaded a renamed 7z.exe via ZohoMeeting.7z. A vulnerable driver, rsndispot.sys, was staged in C:\programdata as an EDR killer, and a Warlock AV-killer DLL was also recovered. Network IOCs include HostHatch-hosted SPN nodes and bulletproof-hosted C2 servers.

Attribution to Storm-2603 is moderate-confidence. Microsoft assesses Storm-2603 as likely China-based and notes it has previously deployed Warlock and LockBit 3.0 ransomware after exploiting ToolShell in July 2025, including MachineKey theft via spinstall0.aspx, Mimikatz, PsExec/WMI lateral movement and GPO-based ransomware distribution. The victim sector and region are not stated in the Securelist report. Detection guidance covers ETW deserialization artifacts (Microsoft.GeneratedCode, App_Web_toolpane.aspx, ObjectDataProvider/ExpandedWrapper/LosFormatter gadgets) and Microsoft-Windows-IIS-Configuration ETW events 25/47 without matching file-change events 17/18/19/21 as a sign of virtual (memory-only) content.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1218.007 System Binary Proxy Execution: Msiexec; T1574.001 Hijack Execution Flow: DLL; T1620 Reflective Code Loading

Discovery

T1033 System Owner/User Discovery; T1049 System Network Connections Discovery; T1057 Process Discovery

Command and Control

T1090 Proxy; T1219 Remote Access Tools; T1572 Protocol Tunneling; T1573.001 Encrypted Channel: Symmetric Cryptography

Privilege Escalation

T1134.001 Access Token Manipulation: Token Impersonation/Theft

Persistence

T1136.001 Create Account: Local Account; T1505.003 Server Software Component: Web Shell

Initial Access

T1190 Exploit Public-Facing Application

defense-impairment

T1685 Disable or Modify Tools

Remediation for Storm-2603 SharePoint ToolShell

Patches

• Microsoft SharePoint security updates KB5002768, KB5002754 and KB5002760
• Velociraptor 0.74.3 or later for CVE-2025-6264

Immediate actions

• Apply Microsoft SharePoint security updates (KB5002768, KB5002754, KB5002760) and restart IIS
• Rotate ASP.NET MachineKeys (validation/decryption keys) and any exposed credentials
• Preserve memory and IIS telemetry, then contain hosts with confirmed SharePoint exploitation
• Block the listed IPs and domains and the abused tunneling and remote-management endpoints at the perimeter
• Enable AMSI in Full Mode for SharePoint

Workarounds

• Disconnect end-of-life SharePoint versions (2013 and earlier) from the internet
• Restrict internet access to the SharePoint ToolPane endpoint until patched

Longer-term hardening

• Hunt for fileless w3wp.exe implants using IIS ETW (Microsoft-Windows-IIS-Configuration events 25/47 without 17/18/19/21)
• Monitor ETW/memory for deserialization artifacts (Microsoft.GeneratedCode, App_Web_toolpane.aspx, ObjectDataProvider, ExpandedWrapper, LosFormatter)
• Alert on unsanctioned Velociraptor, Zoho Assist, VS Code tunnel and cloudflared installs on servers
• Block vulnerable-driver loads (HVCI/WDAC driver blocklist, including rsndispot.sys)
• Do not expose on-prem SharePoint directly to the internet

Affected and fixed versions

• Microsoft — SharePoint Server (on-premises)
  Vulnerable versions: SharePoint Enterprise Server 2016 < 16.0.5513.1001; SharePoint Server 2019 < 16.0.10417.20037; SharePoint Server Subscription Edition < 16.0.18526.20508
  Fixed in: 2016 16.0.5513.1001 or later (KB5002760); 2019 16.0.10417.20037 or later (KB5002754); Subscription Edition 16.0.18526.20508 or later (KB5002768)
• Rapid7 / Velociraptor — Velociraptor
  Vulnerable versions: All versions before 0.74.3 (abused: 0.73.4.0)
  Fixed in: 0.74.3

Timeline of Storm-2603 SharePoint ToolShell

• 2025-06-20 CVE-2025-6264 (Velociraptor Admin.Client.UpdateClientConfig permission flaw, fixed in 0.74.3) is published; the version later abused in this incident (0.73.4.0) is vulnerable.
• 2025-07-07 Microsoft observes initial ToolShell exploitation attempts against on-premises SharePoint.
• 2025-07-18 Microsoft observes Storm-2603 ransomware deployment (Warlock, LockBit) following SharePoint exploitation.
• 2025-07-19 Microsoft publicly discloses active exploitation of SharePoint (CVE-2025-53770 / CVE-2025-53771).
• 2025-07-20 CVE-2025-53770 is published to NVD and added to the CISA KEV catalog with a next-day action deadline.
• 2025-07-22 Microsoft attributes SharePoint exploitation and ransomware deployment to Storm-2603 with moderate confidence, publishing IOCs and remediation (KB5002768, KB5002754, KB5002760).
• 2025-12-20 Attacker fingerprints the victim's SharePoint ToolPane endpoint (visible via ONYPHE). The source gives no year; 2025 is inferred.
• 2025-12-24 After a three-day pause, the full RCE chain runs in w3wp.exe, deploying the in-memory C# webshell framework and follow-on tooling (Velociraptor, Zoho Assist, tunnels, rsndispot.sys).
• 2025-12-26 Kaspersky discovers the intrusion during retrospective analysis.
• 2026-11-05 Securelist publishes 'The SOC Files 5' describing the fileless Storm-2603 ToolShell breach.

Sources cited for Storm-2603 SharePoint ToolShell

• NVD - CVE-2025-53770 NVD (NIST) · Advisory · 2025-07-20
• NVD - CVE-2025-53771 NVD (NIST) · Advisory · 2025-07-20
• NVD - CVE-2025-6264 (Velociraptor) NVD (NIST) · Advisory · 2025-06-20
• CISA Known Exploited Vulnerabilities Catalog (CVE-2025-53770 added 2025-07-20) CISA · Government advisory · 2025-07-20
• Storm-2603 exploits SharePoint vulnerabilities to deliver backdoor and Warlock ransomware (IMDA advisory) imda.gov.sg · Advisory
• The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603 Kaspersky Securelist · Research · 2026-11-05
• Disrupting active exploitation of on-premises SharePoint vulnerabilities (Microsoft) Microsoft · Vendor report · 2025-07-22
• Warlock Ransomware: Old Actor, New Tricks? (Symantec) security.com · Research

More in vulnerability

• OpenSSH on musl libc (Alpine Linux) authentication bypass via overly long password ("*sshole")
• Apache OFBiz Pre-Auth RCE (CVE-2026-68524) and Account Takeover (CVE-2026-109928) Patched in 24.09.08
• ChatGPT Lockdown Mode Bypass via HTML Preview Nested Iframes Enables Phishing, Malware Delivery, and Silent Data Exfiltration
• Fastjson 1.x Gadget-Free RCE (CVE-2026-16723 / ThreatBook XVE-2026-39684) Under Active Exploitation
• GhostMap: Android ZIP-parsing flaw (libziparchive/libandroidfw mismatch) lets a malicious APK trigger a persistent system_server crash loop