confirmed research (Kaspersky Securelist SOC Files, Nov 5; Storm-2603 attribution moderate confidence)
Hunt: Storm-2603 kept a SharePoint ToolShell intrusion entirely in w3wp.exe memory, then used Velociraptor and tunnels to try Warlock ransomware
Exploit evidence: a ToolPane request followed by Microsoft.GeneratedCode and App_Web_toolpane.aspx* assemblies loading in the same window; strings like ObjectDataProvider, ExpandedWrapper, LosFormatter in w3wp.exe memory.
Fileless webshell: IIS-Configuration ETW events 25 and 47 for a path with no file on disk and no matching FileChangeNotification events (17, 18, 19, 21).
Post-exploitation: w3wp.exe spawning msiexec; Velociraptor 0.73.4 (CVE-2025-6264) you didn't install; VS Code / VS Code Insiders tunnels; cloudflared; Zoho Assist unattended agent; driver rsndispot.sys.
IOCs:45.91.94[.]204, 49.51.132[.]100 (SPN nodes), 91.224.92[.]121, 204.76.203[.]219 (C2), auth[.]qgtxtebl[.]workers[.]dev, vdfccjpnedujhrzscjtq[.]supabase[.]co; driver MD5 054a32d6033b1744dca7f49b2e466ea2. Full list in the report.
After any confirmed SharePoint compromise, rotate the ASP.NET MachineKey as well as credentials; a restart clears the in-memory implant but not the accounts and tunnels it created.