Storm-2603 used ToolShell SharePoint flaws in a fileless intrusion over Christmas
VULNERABILITYMicrosoftredteam/daily · 1 source
- Severity
- High
- Exploited
- Yes
- Sources
- 1
What happened
Attackers exploited weaknesses in on-premises Microsoft SharePoint servers to take control of them. They hid their access in the server's memory, so very little was written to disk, which made the intrusion harder to spot.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Investigate any unexplained w3wp.exe activity, as the webshell ran in memory and left few disk artefacts.
- Treat earlier low-priority probes against exposed SharePoint hosts as possible reconnaissance for a later intrusion.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
Kaspersky Securelist
Who and what is in it
Companies