---
title: Hunt: Storm-2603 kept a SharePoint ToolShell intrusion entirely in w3wp.exe memory, then used Velociraptor and tunnels to try Warlock ransomware | ctxsec
url: https://ctxsec.com/items/hunt-securelist-storm-2603-fileless-toolshell-vpp-webshell-velociraptor-warlock
description: "Kaspersky describes a December intrusion on an on-prem SharePoint server: a vulnerability probe (from an ONYPHE scanner) on Dec 20, three quiet days, then full ToolShell (CVE-2025-53770) exploitation on Christmas Eve from a Safing Privacy Network node. The webshell ran only in the IIS worker process, registering a custom ASP.NET VirtualPathProvider and waking on a specific User-Agent, tunneling with suo5, creating admin accounts via SAM RPC and escalating to SYSTEM with an EfsPotato variant. The attacker then installed a vulnerable Velociraptor 0.73.4 from Supabase storage, added Zoho Assist, VS Code tunnels and Cloudflare Tunnel, loaded a vulnerable driver to kill EDR, and tried to run Warlock ransomware, which was blocked."
status: "confirmed research (Kaspersky Securelist SOC Files, Nov 5; Storm-2603 attribution moderate confidence)"
published: 2026-11-05
---

> Kaspersky describes a December intrusion on an on-prem SharePoint server: a vulnerability probe (from an ONYPHE scanner) on Dec 20, three quiet days, then full ToolShell (CVE-2025-53770) exploitation on Christmas Eve from a Safing Privacy Network node. The webshell ran only in the IIS worker process, registering a custom ASP.NET VirtualPathProvider and waking on a specific User-Agent, tunneling with suo5, creating admin accounts via SAM RPC and escalating to SYSTEM with an EfsPotato variant. The attacker then installed a vulnerable Velociraptor 0.73.4 from Supabase storage, added Zoho Assist, VS Code tunnels and Cloudflare Tunnel, loaded a vulnerable driver to kill EDR, and tried to run Warlock ransomware, which was blocked.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-securelist-storm-2603-fileless-toolshell-vpp-webshell-velociraptor-warlock.md)

confirmed research (Kaspersky Securelist SOC Files, Nov 5; Storm-2603 attribution moderate confidence)

2026-11-05

### Hunt: Storm-2603 kept a SharePoint ToolShell intrusion entirely in w3wp.exe memory, then used Velociraptor and tunnels to try Warlock ransomware

- **Exploit evidence:** a ToolPane request followed by `Microsoft.GeneratedCode` and `App_Web_toolpane.aspx*` assemblies loading in the same window; strings like `ObjectDataProvider`, `ExpandedWrapper`, `LosFormatter` in w3wp.exe memory.
- **Fileless webshell:** IIS-Configuration ETW events 25 and 47 for a path with no file on disk and no matching FileChangeNotification events (17, 18, 19, 21).
- **Post-exploitation:** w3wp.exe spawning msiexec; Velociraptor 0.73.4 (CVE-2025-6264) you didn't install; VS Code / VS Code Insiders tunnels; cloudflared; Zoho Assist unattended agent; driver `rsndispot.sys`.
- **IOCs:** `45.91.94[.]204`, `49.51.132[.]100` (SPN nodes), `91.224.92[.]121`, `204.76.203[.]219` (C2), `auth[.]qgtxtebl[.]workers[.]dev`, `vdfccjpnedujhrzscjtq[.]supabase[.]co`; driver MD5 `054a32d6033b1744dca7f49b2e466ea2`. Full list in the report.
- After any confirmed SharePoint compromise, rotate the ASP.NET MachineKey as well as credentials; a restart clears the in-memory implant but not the accounts and tunnels it created.

Sources: [Securelist: The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603 (Nov 5)](https://securelist.com/storm-2603-fileless-toolshell-attack/121467/)