# Storm-2603 Fileless ToolShell Breach of On-Prem SharePoint (CVE-2025-53770 / CVE-2025-53771) with Warlock/LockBit Ransomware

> Kaspersky Securelist's incident report describes a fileless, in-memory compromise of an on-premises Microsoft SharePoint server through the ToolShell vulnerabilities. Securelist attributes it to Storm-2603 with moderate confidence. The attacker ran a modular C# webshell inside the IIS w3wp.exe worker process, abused Velociraptor 0.73.4.0, Zoho Assist, VS Code tunneling and Cloudflare Tunnel, and dropped the vulnerable driver rsndispot.sys as an EDR killer.

- **Published:** 2026-11-05T10:24:49Z
- **Last reviewed:** 2026-11-05T10:24:49Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5315
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5315.png
- **ID:** TL-2026-5315
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Storm-2603 (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)
- **CVEs:** CVE-2025-53770, CVE-2025-53771, CVE-2025-6264

## Description

In the incident Kaspersky analyzed, the attacker first fingerprinted the SharePoint ToolPane endpoint (observed via ONYPHE, Dec 20), went quiet for three days (Dec 21-23), then executed a full remote-code-execution chain on Dec 24 through the IIS worker process w3wp.exe. The chain abuses the ToolShell deserialization/authentication-bypass flaws (CVE-2025-53770, with CVE-2025-53771 as the related spoofing/path-traversal bypass). Kaspersky found the incident on Dec 26 during retrospective analysis. The source does not state the year; this record uses 2025 for those dates.

The implant was fileless. Control stayed inside w3wp.exe, with no webshell written to disk. It was a multi-module C# framework: G.cs (pipeline control, session management and a custom binary C2 protocol with XOR obfuscation), Prog.cs (entry point and task dispatcher), FileDownloader.cs, LoggedOnUsers.cs, ProcessList.cs, NetworkInfo.cs, MSI.cs (silent MSI install), User.cs (creates administrative accounts through SAM RPC via a samlib.dll P/Invoke wrapper) and London.cs (command orchestrator with EFSRPC/EfsPotato-style token-impersonation privilege escalation). Persistence relied on VirtualPathProvider registration, so the content exists only in memory with no matching file on disk.

For follow-on tooling the attacker used a Velociraptor 0.73.4.0 MSI pulled from a Supabase storage URL and pointed at a workers.dev server. Velociraptor 0.73.4.0 is affected by CVE-2025-6264 (fixed in 0.74.3). The attacker also installed Zoho Assist Unattended Agent from a catbox.moe-hosted MSI, used VS Code CLI tunneling, Cloudflare Tunnel (cloudflared) and the suo5 reverse proxy for persistent encrypted access, and sideloaded a renamed 7z.exe via ZohoMeeting.7z. A vulnerable driver, rsndispot.sys, was staged in C:\programdata as an EDR killer, and a Warlock AV-killer DLL was also recovered. Network IOCs include HostHatch-hosted SPN nodes and bulletproof-hosted C2 servers.

Attribution to Storm-2603 is moderate-confidence. Microsoft assesses Storm-2603 as likely China-based and notes it has previously deployed Warlock and LockBit 3.0 ransomware after exploiting ToolShell in July 2025, including MachineKey theft via spinstall0.aspx, Mimikatz, PsExec/WMI lateral movement and GPO-based ransomware distribution. The victim sector and region are not stated in the Securelist report. Detection guidance covers ETW deserialization artifacts (Microsoft.GeneratedCode, App_Web_toolpane.aspx, ObjectDataProvider/ExpandedWrapper/LosFormatter gadgets) and Microsoft-Windows-IIS-Configuration ETW events 25/47 without matching file-change events 17/18/19/21 as a sign of virtual (memory-only) content.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1505.003 Server Software Component: Web Shell
- T1620 Reflective Code Loading
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1218.007 System Binary Proxy Execution: Msiexec
- T1574.001 Hijack Execution Flow: DLL
- T1134.001 Access Token Manipulation: Token Impersonation/Theft
- T1136.001 Create Account: Local Account
- T1057 Process Discovery
- T1033 System Owner/User Discovery
- T1049 System Network Connections Discovery
- T1219 Remote Access Tools
- T1572 Protocol Tunneling
- T1090 Proxy
- T1573.001 Encrypted Channel: Symmetric Cryptography

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**IIS w3wp.exe Spawning Shells, Discovery Tools and Account Creation (ToolShell Post-Exploitation)** (`TL-2026-5315-SPL-002`)

Detects the SharePoint application pool worker w3wp.exe spawning command interpreters, discovery utilities (whoami, tasklist, netstat, ipconfig, nltest), net user/localgroup account creation or msiexec. This is how the Storm-2603 in-memory C# webshell framework (ProcessList, LoggedOnUsers, NetworkInfo, MSI and User modules) shows up in process telemetry. Children running as SYSTEM point to EfsPotato-style token impersonation.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1505.003, T1033, T1057, T1049, T1136.001, T1218.007, T1134.001
- **Data sources:** sysmon_event_id_1, microsoft_defender_DeviceProcessEvents, windows_security_4688
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| where match(ParentImage,"(?i)w3wp[.]exe$")
| where match(Image,"(?i)(cmd|powershell|pwsh|whoami|tasklist|netstat|ipconfig|net|net1|msiexec|certutil|bitsadmin|curl|wmic|nltest|systeminfo|quser)[.]exe$")
| eval is_system=if(match(User,"(?i)SYSTEM$"),1,0)
| eval tradecraft=case(match(CommandLine,"(?i)net1?([.]exe)?.{0,2}[ ]+(user|localgroup)[ ]+.*(/add|administrators)"),"T1136.001_local_account_creation", match(Image,"(?i)msiexec[.]exe$"),"T1218.007_msi_install", match(Image,"(?i)(whoami|quser)[.]exe$"),"T1033_user_discovery", match(Image,"(?i)tasklist[.]exe$"),"T1057_process_discovery", match(Image,"(?i)(netstat|ipconfig|nltest)[.]exe$"),"T1049_network_discovery", true(),"w3wp_child_shell")
| stats count min(_time) as first_seen max(_time) as last_seen values(tradecraft) as tradecraft values(Image) as child_images values(CommandLine) as command_lines max(is_system) as ran_as_system by host ParentCommandLine User
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ 'w3wp.exe'
| where FileName in~ ('cmd.exe', 'powershell.exe', 'pwsh.exe', 'whoami.exe', 'tasklist.exe', 'netstat.exe', 'ipconfig.exe', 'net.exe', 'net1.exe', 'msiexec.exe', 'certutil.exe', 'bitsadmin.exe', 'curl.exe', 'wmic.exe', 'nltest.exe', 'systeminfo.exe', 'quser.exe')
| extend Tradecraft = case(
    FileName in~ ('net.exe', 'net1.exe') and ProcessCommandLine matches regex @'(?i)(user|localgroup)[ ]+.*(/add|administrators)', 'T1136.001_local_account_creation',
    FileName =~ 'msiexec.exe', 'T1218.007_msi_install',
    FileName in~ ('whoami.exe', 'quser.exe'), 'T1033_user_discovery',
    FileName =~ 'tasklist.exe', 'T1057_process_discovery',
    FileName in~ ('netstat.exe', 'ipconfig.exe', 'nltest.exe'), 'T1049_network_discovery',
    'w3wp_child_shell'),
  RanAsSystem = toint(AccountName =~ 'system')
| summarize Events = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Tradecraft = make_set(Tradecraft), CommandLines = make_set(ProcessCommandLine, 10), RanAsSystem = max(RanAsSystem) by DeviceName, InitiatingProcessCommandLine, AccountName
| order by LastSeen desc
```

### Sigma

```yaml
title: IIS Worker Process w3wp Spawning Shell or Discovery Utility
id: b7e40d93-2a6c-4c18-8e5f-1d9a3b6c7f22
status: experimental
description: Detects w3wp.exe spawning command interpreters, discovery tools, net user/localgroup or msiexec. Consistent with the Storm-2603 fileless C# webshell framework running inside the SharePoint worker process after ToolShell exploitation.
references:
  - https://securelist.com/storm-2603-fileless-toolshell-attack/121467/
  - https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.discovery
  - attack.t1033
  - attack.t1057
  - attack.t1049
  - attack.t1136.001
  - attack.defense-evasion
  - attack.t1218.007
  - attack.privilege-escalation
  - attack.t1134.001
  - cve.2025-53770
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\whoami.exe'
      - '\tasklist.exe'
      - '\netstat.exe'
      - '\ipconfig.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\msiexec.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wmic.exe'
      - '\nltest.exe'
      - '\systeminfo.exe'
      - '\quser.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Custom IIS applications that legitimately shell out to cmd.exe or powershell.exe
  - Health-check or diagnostic scripts launched by the application pool
level: high
```

**Known false positives:**

- Custom IIS web applications that legitimately shell out to cmd.exe or powershell.exe
- SharePoint health-analyzer or diagnostic scripts launched under the application pool identity

**Tuning notes:** Scope to SharePoint web front-end and application servers. Baseline legitimate w3wp children for 7-14 days and exclude by exact CommandLine. ran_as_system=1 on a w3wp child is a strong escalation signal (EfsPotato-style token impersonation) and should page the on-call analyst. SharePoint legitimately spawns csc.exe for ASP.NET compilation, so csc.exe is deliberately not in the child list.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SharePoint w3wp.exe In-Memory .NET Module and ASPX Drop (Fileless Webshell / MachineKey Theft) (locked: unlock with TL Creds)
- Local Administrator Account Created by Machine/SYSTEM Context (ToolShell User Module Persistence) (locked: unlock with TL Creds)
- Storm-2603 C2 Infrastructure and Tunnel Egress (cloudflared, VS Code Tunnel, Velociraptor, w3wp Public Egress) (locked: unlock with TL Creds)
- SharePoint spinstall0.aspx MachineKey-Theft Webshell Access and ToolShell Source IPs (locked: unlock with TL Creds)
- BYOVD EDR Killer rsndispot.sys and Warlock AV-Killer DLL Staging (locked: unlock with TL Creds)
- Storm-2603 C2 and Tunnel Domain DNS Lookups (updatemicfosoft, ngrok, workers.dev, argotunnel, devtunnels) (locked: unlock with TL Creds)
- SharePoint ToolShell ToolPane.aspx Exploitation (CVE-2025-53770 / CVE-2025-53771) - Exploitation Phase (locked: unlock with TL Creds)
- Abused Remote Access Tooling Install - Velociraptor, Zoho Assist, VS Code Tunnel, cloudflared, Remote MSI (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- IP address: `45.91.94[.]204`
- Domain: `update[.]updatemicfosoft[.]com`
- URL: `hxxps://vdfccjpnedujhrzscjtq[.]supabase[.]co/storage/v1/object/public/image/v4.msi`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603](https://securelist.com/storm-2603-fileless-toolshell-attack/121467/)
- [Disrupting active exploitation of on-premises SharePoint vulnerabilities (Microsoft)](https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/)
- [NVD - CVE-2025-53770](https://nvd.nist.gov/vuln/detail/CVE-2025-53770)
- [NVD - CVE-2025-53771](https://nvd.nist.gov/vuln/detail/CVE-2025-53771)
- [NVD - CVE-2025-6264 (Velociraptor)](https://nvd.nist.gov/vuln/detail/CVE-2025-6264)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2025-53770 added 2025-07-20)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Warlock Ransomware: Old Actor, New Tricks? (Symantec)](https://www.security.com/blog-post/warlock-ransomware-origins)
- [Storm-2603 exploits SharePoint vulnerabilities to deliver backdoor and Warlock ransomware (IMDA advisory)](https://www.imda.gov.sg/-/media/imda/files/regulations-and-licensing/regulations/advisories/infocomm-media-cyber-security/storm-2603-exploits-sharepoint-vulnerabilities-to-deliver-backdoor-and-warlock-ransomware.pdf)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5315