Ghost in the Pipeline: How Storm-2603 Used a Fileless SharePoint Webshell to Stage Ransomware
In December 2025, the ransomware-affiliated threat actor Storm-2603 exploited CVE-2025-53770 and CVE-2025-53771 (collectively 'ToolShell') in on-premises Microsoft SharePoint to achieve fileless remote code execution. Beginning with a low-noise vulnerability fingerprint on December 20, the actor waited three days before launching the full exploit chain on Christmas Eve—when security staffing was reduced. A modular C# webshell was injected entirely into the IIS worker process (w3wp.exe) in memory, enabling tunneling, privilege escalation via EfsPotato, credential access, and lateral movement without writing to disk. Post-exploitation activity included deployment of Velociraptor, multiple encrypted tunneling tools, an EDR-killing driver, and ultimately an attempted Warlock ransomware detonation. This incident marks a significant escalation in fileless, memory-resident attack techniques against enterprise collaboration platforms. Storm-2603's deliberate timing, use of privacy networks to obscure origin, and layered redundant persistence mechanisms reflect a maturing operational playbook that bypasses file-based detection entirely—raising the bar for defenders relying on traditional endpoint and perimeter controls.
Kill Chain
