Storm-2603's SharePoint foothold hid in IIS memory
Kaspersky's retrospective analysis found December activity consistent with Storm-2603's tactics against on-premises Microsoft SharePoint: attackers probed on Dec. 20, then exploited ToolShell flaws CVE-2025-53770 and CVE-2025-53771 on Dec. 24. A three-day silence separated the probe from exploitation; the report also describes command execution through a vulnerable DFIR tool, version 0.73.4.0 (CVE-2025-6264).
The attacker used SharePoint's Internet Information Services (IIS) worker, w3wp.exe, as an in-memory relay: the access bridge stayed in the process rather than being saved as a file. Later malicious activity did leave files on disk, so a disk search might find signs of the intrusion without revealing the mechanism maintaining access.
The Dec. 20 probe was initially marked low priority and only tied to the later exploitation in retrospective analysis. For organizations running on-premises SharePoint, isolated probes can be separated from later attacks; if the vulnerable DFIR tool is also in the environment, the reported command execution extends the incident beyond SharePoint.
CVSS 9.8 CRITICAL: deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to… Known ransomware campaign use. EPSS 100% (100th percentile).
CISA federal remediation date Jul 21 · date passed
CVSS 6.5 MEDIUM: improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a… EPSS 100% (100th percentile).
How to detect fileless attacks exploiting ToolShell: analyzing the Storm-2603 incident
Kaspersky researchers analyze a complex fileless cyberattack by Storm-2603 involving ToolShell exploitation and subsequent runtime subversion, and discuss how to detect such intrusions.