In 2025, threat actors exploited CVE-2025-53770 and CVE-2025-53771 (ToolShell vulnerabilities) in on-premises Microsoft SharePoint to achieve remote code execution. Storm-2603 deployed ransomware following successful exploitation. Analysis of a December incident revealed attackers using the IIS worker process as an in-memory bridge, maintaining access entirely within w3wp.exe without writing to disk. The intrusion occurred in two stages: initial vulnerability fingerprinting on December 20, followed by full exploitation on December 24. The attackers deployed a fileless webshell framework with multiple modules for reconnaissance, privilege escalation via token impersonation, and persistence. Post-exploitation activities included deploying Velociraptor for command execution, establishing multiple tunneling mechanisms, attempting to kill EDR solutions using vulnerable drivers, and deploying Warlock ransomware.