Storm-2603 used ToolShell SharePoint flaws in a fileless intrusion over Christmas
VULNERABILITYMicrosoftredteam/daily · 1 source
- Severity
- High
- Exploited
- Yes
- Sources
- 1
What happened
CVE-2025-53770 and CVE-2025-53771 (ToolShell) in on-premises Microsoft SharePoint were used for RCE via crafted HTTP requests against the ToolPane endpoint; Microsoft attributes ransomware-linked activity to Storm-2603. A fingerprinting probe on 20 December (ONYPHE-style marker injection) was followed by full exploitation on 24 December from 45.91.94.204, a Safing Privacy Network node, with a memory-only webshell in w3wp.exe. Defenders should hunt for requests to the SharePoint ToolPane endpoint and unexpected w3wp.exe behaviour, since the in-memory implant leaves little disk evidence.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Investigate any unexplained w3wp.exe activity, as the webshell ran in memory and left few disk artefacts.
- Treat earlier low-priority probes against exposed SharePoint hosts as possible reconnaissance for a later intrusion.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
Kaspersky Securelist
Who and what is in it
Companies