Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In December 2025, the ransomware-affiliated threat actor Storm-2603 exploited CVE-2025-53770 and CVE-2025-53771 (collectively 'ToolShell') in on-premises Microsoft SharePoint to achieve fileless remote code execution. Beginning with a low-noise vulnerability fingerprint on December 20, the actor waited three days before launching the full exploit chain on Christmas Eve—when security staffing was reduced. A modular C# webshell was injected entirely into the IIS worker process (w3wp.exe) in memory, enabling tunneling, privilege escalation via EfsPotato, credential access, and lateral movement without writing to disk. Post-exploitation activity included deployment of Velociraptor, multiple encrypted tunneling tools, an EDR-killing driver, and ultimately an attempted Warlock ransomware detonation.

This incident marks a significant escalation in fileless, memory-resident attack techniques against enterprise collaboration platforms. Storm-2603's deliberate timing, use of privacy networks to obscure origin, and layered redundant persistence mechanisms reflect a maturing operational playbook that bypasses file-based detection entirely—raising the bar for defenders relying on traditional endpoint and perimeter controls.

Why This Matters Now

SharePoint ToolShell (CVE-2025-53770/53771) is actively exploited by multiple threat actors in 2025, with Storm-2603 now deploying ransomware after fileless compromise. Organizations running on-premises SharePoint face immediate risk; memory-resident webshells evade file-based EDR and log-based SIEM detections, demanding runtime behavioral monitoring and network segmentation to contain lateral movement before ransomware detonates.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Storm-2603 injected a modular C# webshell directly into the IIS worker process (w3wp.exe) memory using a custom VirtualPathProvider registered at runtime. This in-memory implant persisted for the lifetime of the application pool without creating disk artifacts, making it invisible to file-based endpoint detection tools.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant here because Storm-2603 relied on an internet-exposed SharePoint server as a beachhead to pivot freely across internal segments and establish multiple encrypted outbound channels. By enforcing workload-level segmentation and restricting east-west reachability, CNSF would likely have reduced the attacker's ability to traverse internal network boundaries and reach downstream hosts from the initial compromised IIS process.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: CNSF's perimeter-aware fabric would likely constrain the reachability of the internet-facing SharePoint workload by reducing its exposure surface to only explicitly permitted inbound paths, making broad scanning and exploit delivery from anonymization nodes like Safing Privacy Network less likely to reach the target unimpeded.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation would likely reduce the scope of what a compromised IIS workload can communicate with internally, constraining the EFSRPC-based coercion path that depended on the w3wp.exe process having unrestricted access to interact with privileged OS interfaces and internal RPC endpoints across the host boundary.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic enforcement would likely constrain the attacker's ability to route arbitrary TCP connections from the compromised SharePoint workload to other internal hosts, reducing the reachability of internal segments that the suo5 proxy tunnel depended on to pivot across network boundaries from a single beachhead.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility and centralized control would likely surface anomalous outbound connection patterns from the compromised workload toward multiple unrecognized external relay endpoints, and policy enforcement across egress paths could reduce the number of redundant C2 channels that remain operational without triggering detection or policy blocks.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Controlled egress enforcement would likely reduce the attacker's ability to move collected data outbound by constraining which external destinations the compromised workload is permitted to establish encrypted sessions with, limiting the utility of the proxy tunnel and redundant C2 channels as covert exfiltration paths.

Impact (Mitigations)

Because east-west segmentation and egress controls would likely have constrained the attacker's lateral reach and C2 redundancy in earlier stages, the blast radius of the ransomware deployment would likely be reduced to a smaller set of reachable hosts rather than spanning across internally connected segments and cloud workloads.

Impact at a Glance

Affected Business Functions

  • Enterprise Collaboration and Document Management (SharePoint Intranet Portal)
  • IT Infrastructure and Network Operations
  • Identity and Access Management (Active Directory / SAM)
  • Endpoint Security and Incident Response Operations
Operational Disruption

Estimated downtime: 6 days

Financial Impact

Estimated loss: N/A

Data Exposure

The fileless intrusion through on-premises SharePoint exposed internal network topology, enumerated logged-on user sessions, process listings, and network connection metadata harvested via the in-memory webshell modules. Credential material was at risk through SYSTEM-level token impersonation via EFSRPC and covert administrative account creation via SAMRPCNative. Internal file systems were traversable through the bidirectional TCP tunnel, enabling potential exfiltration of corporate documents, intellectual property, and sensitive configuration data residing on the SharePoint server and adjacent network hosts. Attempted Warlock ransomware deployment, if successful, would have resulted in encryption of business-critical data. Actual confirmed exfiltration volume was not disclosed; however, the multi-day dwell time with active tunneling tools (Cloudflare Tunnel, VS Code CLI, Zoho Assist) indicates a high probability of staged data collection prior to ransomware deployment.

Recommended Actions

  • •

    Deploy Cloud Native Security Fabric (CNSF) with Inline IPS (Suricata) on internet-facing application perimeters: CVE-2025-53770/53771 exploitation used crafted HTTP requests with known deserialization gadget chain signatures. Inline IPS with signature coverage for ToolShell payloads, BinaryFormatter gadget chains (ysoserial.net patterns), and LosFormatter abuse would have detected and blocked the initial RCE request before it reached the ASP.NET pipeline, directly interrupting Initial Compromise.

  • •

    Enforce Zero Trust Segmentation and East-West Traffic Security to contain lateral movement: The actor used an in-memory TCP proxy (suo5) through the compromised w3wp.exe process to pivot to internal hosts. Microsegmentation policies enforcing workload-to-workload identity-based controls and blocking unauthorized service-to-service TCP flows from IIS worker processes to internal network segments would have prevented lateral pivoting and contained the blast radius to the initially compromised SharePoint host.

  • •

    Implement Egress Security and Policy Enforcement with FQDN filtering to block C2 and payload staging: The actor staged Velociraptor from Supabase cloud storage, downloaded cloudflared from GitHub, and communicated with Cloudflare Workers and bulletproof-hosted C2 servers. Egress security with FQDN-based filtering and application-to-internet policy enforcement would have blocked outbound connections to unauthorized destinations including supabase.co staging URLs, catbox.moe, and anonymous relay infrastructure, cutting off both payload delivery and C2 channel establishment.

  • •

    Apply Multicloud Visibility and Control with anomaly detection on outbound and internal application traffic: The webshell remained dormant until a specific User-Agent triggered execution, blending into normal HTTP traffic. Centralized traffic observability with behavioral baselining would have flagged anomalous patterns including unexpected TCP tunnel initiation from w3wp.exe, unusual outbound connection volumes, repeated structured requests to ToolPane endpoints, and process spawning chains from IIS worker processes, enabling earlier detection of C2 activity.

  • •

    Use Cloud Firewall (ACF) with URL filtering for internet egress control to prevent multi-channel C2 redundancy: Storm-2603 deployed five independent C2 and tunneling mechanisms (suo5, Velociraptor, VS Code CLI, Cloudflare Tunnel, Zoho Assist) to maintain persistence. A cloud firewall enforcing allowlisted egress destinations, blocking unsanctioned remote management tools, and applying URL and application-layer filtering on outbound traffic would have prevented the actor from establishing redundant encrypted tunnel channels and significantly degraded their ability to maintain persistent access after initial detection.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image