Storm-2603 used ToolShell SharePoint flaws in a fileless intrusion over Christmas
VULNERABILITYMicrosoftredteam/daily · 1 source
- Severity
- High
- Exploited
- Yes
- Sources
- 1
What happened
Storm-2603 exploited CVE-2025-53770 and CVE-2025-53771 (ToolShell) in on-premises SharePoint to achieve remote code execution. The attacker ran a webshell inside the IIS worker process (w3wp.exe) that stayed memory-resident, after an initial probe on 20 December and a full exploitation on 24 December. The first probe was initially rated low priority and only linked to the intrusion retrospectively.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Investigate any unexplained w3wp.exe activity, as the webshell ran in memory and left few disk artefacts.
- Treat earlier low-priority probes against exposed SharePoint hosts as possible reconnaissance for a later intrusion.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
Kaspersky Securelist
Who and what is in it
Companies