Executive Summary
In late 2025, the threat actor Storm-2603 was observed exploiting on-premises Microsoft SharePoint vulnerabilities, specifically CVE-2025-53770 and CVE-2025-53771 (collectively known as ToolShell). The attack utilized a sophisticated fileless methodology where a modular C# webshell framework was injected directly into the IIS worker process (w3wp.exe) memory, evading traditional disk-based detection. This bridgehead allowed the actor to maintain a persistent, memory-resident presence to facilitate post-exploitation activities.
Following initial access, the actor utilized the compromised SharePoint environment as a pivot point, deploying the Velociraptor framework (abusing CVE-2025-6264) and multiple tunneling tools to secure long-term access. The ultimate objective was the deployment of Warlock or LockBit ransomware. While Storm-2603 acts independently, their TTPs emphasize high-intensity engagement during low-staffing periods (e.g., Christmas Eve) and the use of the Safing Privacy Network (SPN) to mask infrastructure.
This campaign represents a significant risk to organizations utilizing on-premises SharePoint. The use of memory-only implants and legitimate remote management tools for persistence necessitates a shift toward runtime behavior monitoring and the correlation of vulnerability scanning with subsequent privileged anomalies.