How to detect fileless attacks exploiting ToolShell: analyzing the Storm-2603 incident

In 2025, threat actors exploited CVE-2025-53770 and CVE-2025-53771 (ToolShell vulnerabilities) in on-premises Microsoft SharePoint to achieve remote code execution. Storm-2603 deployed ransomware following successful exploitation. Analysis of a December incident revealed attackers using the IIS worker process as an in-memory bridge, maintaining access entirely within w3wp.exe without writing to disk. The intrusion occurred in two stages: initial vulnerability fingerprinting on December 20, followed by full exploitation on December 24. The attackers deployed a fileless webshell framework with multiple modules for reconnaissance, privilege escalation via token impersonation, and persistence. Post-exploitation activities included deploying Velociraptor for command execution, establishing multiple tunneling mechanisms, attempting to kill EDR solutions using vulnerable drivers, and deploying Warlock ransomware.

• CVE-2025-53771: Microsoft SharePoint Enterprise Server 2016 · Improper AuthenticationMediumVulnerability2025-07-20
• CVE-2025-53770: Microsoft SharePoint Enterprise Server 2016 · Deserialization of Untrusted DataCriticalVulnerability2025-07-20
• Google Brotli · 2nd November · Threat Intelligence ReportExploitedBreach2026-11-02
• Bulletproof Host Virtualine Loses Its Domain to FBI SeizureNews2026-10-30
• Aurora ransomware targets ESXi abuses Cursor Agent for exploitationMalware2026-10-29