Storm-2603 Hid a SharePoint Webshell in Memory, Then Reached for Warlock

A ransomware crew got into a SharePoint server on Christmas Eve and ran its control layer entirely from memory, with no webshell file anywhere on disk. Kaspersky says the December intrusion matches Storm-2603, the group Microsoft tied to Warlock and LockBit ransomware after last year’s ToolShell SharePoint attacks. The attackers probed the server on Dec. 20, waited three days, then went in, installed backup remote-access tools, tried to kill security software and finally launched Warlock, which was blocked.

hxxps://vdfccjpnedujhrzscjtq[.]supabase[.]co/storage/v1/object/public/image/v4[.]msi (Velociraptor MSI)
hxxps://auth[.]qgtxtebl[.]workers[.]dev/ (Velociraptor server)
hxxps://files[.]catbox[.]moe/8f7vex[.]msi (Zoho Assist agent)
91.224.92[.]121 (C2, bulletproof hosting)
204.76.203[.]219 (C2, bulletproof hosting)

C:\programdata\rsndispot.sys MD5 054a32d6033b1744dca7f49b2e466ea2 (vulnerable driver)
Warlock AV-killer DLL MD5 2d9ebf9c042f596f435865b40edad928
vskp2 webshell implant MD5 fd91321bf7ff7245dda9b7b5d791ace8
C:\ProgramFiles\Velociraptor\Velociraptor.exe MD5 3a55d8f8f29716c694671834d8c6cb29
C:\ProgramFiles(x86)\ZohoMeeting\UnAttended\ZohoMeeting.7z MD5 a930f81e3fb0a226ec5904d9043a17b8

Source article: The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603 (published as “How to detect fileless attacks exploiting ToolShell: analyzing the Storm-2603 incident”)
Publisher: Kaspersky Securelist (Alexander Rodchenko, Rodrigo Wanderson)
Published: Nov. 5, 2026
URL: https://securelist.com/storm-2603-fileless-toolshell-attack/121467/

Executive Summary

Kaspersky attributes, with moderate confidence, a December intrusion into an on-premises Microsoft SharePoint server to Storm-2603, the Microsoft-designated actor that deployed Warlock and LockBit ransomware after exploiting the ToolShell vulnerabilities (CVE-2025-53770 and CVE-2025-53771) in 2025 and that other reporting places behind perimeter mail-gateway exploitation followed by Velociraptor staging; Microsoft tracks it as a standalone actor with no known links to other groups. On Dec. 20 a single request matching the ONYPHE scanning service’s ToolShell check hit the ToolPane endpoint, followed about 12 minutes later by a connection from bulletproof host Pfcloud UG; after three quiet days, on Dec. 24 a crafted request from a Safing Privacy Network relay (45.91.94[.]204) ran the full deserialization chain inside w3wp.exe and loaded a modular C# webshell (vskp2) entirely into memory. The implant registers a custom VirtualPathProvider through non-public ASP.NET methods, subverts BuildManager state so it works in precompiled applications, wakes only for a specific User-Agent, tunnels TCP into the internal network with the suo5 proxy over XOR-obfuscated HTTP, downloads files to ProgramData, enumerates users, processes and network data, creates accounts through samlib.dll, and elevates to SYSTEM via an EfsPotato-derived EFSRPC named-pipe impersonation. Post-exploitation, w3wp.exe launched msiexec to install Velociraptor 0.73.4.0 (vulnerable to CVE-2025-6264) from Supabase storage, which then deployed Zoho Assist unattended access, VS Code CLI tunnels, Cloudflare Tunnel and a reverse proxy; the actor uploaded the vulnerable driver rsndispot.sys and a sideloaded Warlock AV-killer DLL, then tried to run Warlock ransomware, which endpoint protection blocked. The objective was ransomware deployment and extortion, with durable multi-channel access as the means. Hunt leads, false positive expectations and indicators are detailed below; the article links a Russian-language detection paper with YARA examples, but publishes no rule text itself, so none is reproduced.

ATT&CK chain: Reconnaissance → Initial Access → Execution → Persistence → Privilege Escalation → Defense Evasion → Command and Control → Impact

Hunt Lead Grid

Storm-2603 Infrastructure and Tooling Sweep

After the in-memory webshell was running, the IIS worker process installed Velociraptor from hxxps://vdfccjpnedujhrzscjtq[.]supabase[.]co/storage/v1/object/public/image/v4[.]msi to C:\ProgramFiles\Velociraptor\Velociraptor.exe and pointed it at the server URL hxxps://auth[.]qgtxtebl[.]workers[.]dev/. Velociraptor then pulled a Zoho Assist unattended agent from hxxps://files[.]catbox[.]moe/8f7vex[.]msi (staged as C:\ProgramFiles(x86)\ZohoMeeting\UnAttended\ZohoMeeting.7z and unpacked with a renamed 7z.exe used for sideloading), VS Code and VS Code Insiders for CLI tunnels, and cloudflared for a Cloudflare Tunnel. Kaspersky lists 91.224.92[.]121 and 204.76.203[.]219 as bulletproof-hosted C2 servers, and C:\programdata\rsndispot.sys as the vulnerable driver dropped for EDR killing. The detection logic is a retrospective sweep of proxy, DNS and firewall logs for the three attacker URLs (match the full subdomain or path, not supabase.co, workers.dev or catbox.moe as a whole) and the two C2 IPs, plus a file and process sweep for the MD5s in the Hash Appendix and for Velociraptor, Zoho Assist, code tunnel and cloudflared on SharePoint and other IIS servers.

Use web proxy and DNS resolver logs, firewall logs and EDR file and process inventory. Sweep back at least to December 2025, since the intrusion began on Dec. 20 and the Velociraptor and tunnel channels were built to outlive the webshell. Scope to SharePoint servers first, then every server reachable from them. Kaspersky also lists two Safing Privacy Network relays (45.91.94[.]204, which delivered the exploit, and 49.51.132[.]100) and 199.232.210[.]172 as a C2 traffic relay; the SPN addresses are shared anonymity nodes and 199.232.210[.]172 sits in a shared CDN range, so treat hits as context to correlate with other evidence, never as standalone blocks. Do not hash-block the VS Code, VS Code Insiders or cloudflared binaries, which are legitimate and needed by developers; detect them on servers where they were never deployed instead. Any match on the attacker URLs, C2 IPs, implant or driver hash is a confirmed intrusion and goes straight to incident response.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Command and Control → T1105 (Ingress Tool Transfer); Command and Control → T1219 (Remote Access Tools) (our mapping; the source gives no ATT&CK IDs for these steps)

Sources: “How to detect fileless attacks exploiting ToolShell: analyzing the Storm-2603 incident”, Kaspersky Securelist, Nov. 5, 2026, https://securelist.com/storm-2603-fileless-toolshell-attack/121467/ (source article)

ToolPane Request Followed by Generated Serializer Assembly

Both the Dec. 20 probe and the Dec. 24 exploit targeted the SharePoint administrative ToolPane endpoint. When the exploit was processed, the dynamically compiled App_Web_toolpane.aspx assembly and the Microsoft.GeneratedCode helper assembly were loaded into the same application domain; Kaspersky explains that Microsoft.GeneratedCode is produced by XmlSerializer when the runtime must build code to reconstruct a serialized object graph, so its appearance immediately after a ToolPane request means the request carried serialized data. Memory and helper-assembly metadata also held the gadget-chain type names ObjectDataProvider, ExpandedWrapper and LosFormatter. The detection logic correlates IIS logs showing a request to the ToolPane endpoint with CLR loader ETW events (assembly and module load) in w3wp.exe that show Microsoft.GeneratedCode loading in the same application domain within seconds, and raises severity when a memory scan of w3wp.exe or the helper assembly finds those gadget type names.

Use IIS access logs, the Microsoft-Windows-DotNETRuntime loader ETW events (collected by EDR or a dedicated ETW consumer) and on-demand memory scanning of w3wp.exe; Kaspersky’s CLRDeserializationExploitFinder (https://github.com/gam4er/CLRDeserializationExploitFinder) automates the gadget search for ToolShell and other ysoserial.net chains. Sweep IIS logs for ToolPane requests back to July 2025, and remember that the probe and the exploit were four days apart: correlate a scanner-style probe with later activity rather than dismissing it as noise. Scope to every on-premises SharePoint farm, including test farms. Generated serializer assemblies are normal in isolation, so never alert on them alone; the anchor is the ToolPane request in the same window. Blocking the ONYPHE scanner is the wrong fix, since it only told the attacker what the internet already knew; patching and rotating machine keys is the right one. A confirmed sequence means code ran in w3wp.exe: preserve memory before recycling the application pool, because recycling destroys the implant. The pattern generalizes to any .NET deserialization exploit.

Hunt Lead Level: 2 (Pro)

ATT&CK: Initial Access → T1190 (Exploit Public-Facing Application) (our mapping)

Sources: “How to detect fileless attacks exploiting ToolShell: analyzing the Storm-2603 incident”, Kaspersky Securelist, Nov. 5, 2026, https://securelist.com/storm-2603-fileless-toolshell-attack/121467/ (source article)

IIS Worker Launches msiexec or a SYSTEM Child

Shortly after the webshell was injected, w3wp.exe spawned msiexec.exe to install a remote MSI hosted on Supabase storage, which turned out to be Velociraptor. Separately, the implant’s privilege-escalation module (uk/London with an EfsrTiny client derived from EfsPotato) creates a named pipe, calls EfsRpcEncryptFileSrv against the local LSASS RPC server with a crafted \\localhost path so LSASS connects back to that pipe, impersonates the LSASS token with ImpersonateNamedPipeClient and starts a new process as SYSTEM with CreateProcessAsUser, which works because w3wp.exe holds SeImpersonatePrivilege. The detection logic is a process-creation rule for msiexec.exe whose parent is w3wp.exe, or whose command line contains an http or https URL on a server, and a second rule for any process running as SYSTEM whose creator is w3wp.exe or whose parent chain leads back to w3wp.exe, ideally joined with a named-pipe creation by w3wp.exe and an EFSRPC call to LSASS in the same minute.

Use EDR process creation with parent and token details, Sysmon process (ID 1) and pipe events (IDs 17 and 18), and Windows Security 4688 with command lines. Sweep 180 days on SharePoint and other IIS servers. Legitimate SharePoint maintenance installs MSIs from an administrator’s session, not from the worker process, so allowlisting should be by parent session, not by msiexec itself. Blocking msiexec on servers is the wrong control because patching depends on it; restricting w3wp.exe’s child processes with application control is the stronger fix. Any hit should be handled as active compromise: isolate the server, preserve w3wp.exe memory and check for Velociraptor, Zoho Assist, code tunnel and cloudflared installs that followed. The EFSRPC impersonation half generalizes to every Potato-family escalation from a service account.

Hunt Lead Level: 2 (Pro)

ATT&CK: Defense Evasion → T1218.007 (System Binary Proxy Execution: Msiexec); Privilege Escalation → T1134.001 (Access Token Manipulation: Token Impersonation/Theft) (our mapping)

Sources: “How to detect fileless attacks exploiting ToolShell: analyzing the Storm-2603 incident”, Kaspersky Securelist, Nov. 5, 2026, https://securelist.com/storm-2603-fileless-toolshell-attack/121467/ (source article)

Virtual Path With No File Behind It

The webshell’s main module, G.cs, registers a custom VirtualPathProvider through the non-public RegisterVirtualPathProviderInternal method of ASP.NET’s HostingEnvironment, uses reflection to alter BuildManager state so registration also works in precompiled applications, and hooks GetCacheKey() to inspect every request, activating only when a specific User-Agent appears and otherwise staying dormant. Because ASP.NET can compile virtual pages that never exist on disk, file-based webshell hunting finds nothing. Kaspersky’s detection pattern uses the Microsoft-Windows-IIS-Configuration ETW provider: events 25 (ConfigPath to PhysicalPath mapping) and 47 (configuration path to directory mapping) show IIS resolving a path as if it were physical, while the FileChangeNotificationMonitor events 17, 18, 19 and 21 that accompany real files are missing for the same path. The detection logic is a per-path correlation that fires when events 25 or 47 appear for a resource with no file at the mapped physical path and no matching 17, 18, 19 or 21 events.

Collect the Microsoft-Windows-IIS-Configuration ETW provider on SharePoint and other ASP.NET servers, add a filesystem existence check for each mapped path, and back it with periodic memory inspection of w3wp.exe for unknown VirtualPathProvider types. Start by inventorying the legitimate providers your applications register and allowlist them by type and assembly, not by path. Kaspersky’s VirtualPathProvider lab (https://github.com/gam4er/WebApplication) shows what a malicious mapping looks like and is a safe way to test the rule. Hash-based scanning is the wrong control here because the implant has no file; ETW and memory are the only evidence, and both vanish when the application pool recycles, so capture memory first. Any unexplained virtual path is a potential runtime implant and should be escalated. This detection generalizes to every in-memory ASP.NET webshell that uses virtual paths, not just Storm-2603’s.

Hunt Lead Level: 3 (Elite)

ATT&CK: Persistence → T1505.003 (Server Software Component: Web Shell); Defense Evasion → T1620 (Reflective Code Loading) (our mapping; the source cites T1553 (Subvert Trust Controls) for the BuildManager tampering)

Sources: “How to detect fileless attacks exploiting ToolShell: analyzing the Storm-2603 incident”, Kaspersky Securelist, Nov. 5, 2026, https://securelist.com/storm-2603-fileless-toolshell-attack/121467/ (source article)

Hash Appendix

Storm-2603 implant, tooling and driver

MD5s from the source article; SHA-1s and SHA-256s were not published (OTX AlienVault and VirusTotal not checked). The VS Code, VS Code Insiders and cloudflared files are unmodified legitimate software abused for tunneling: blocking their hashes would break legitimate developer tools, so detect them by host role and parent process instead.

MD5s
fd91321bf7ff7245dda9b7b5d791ace8  # vskp2 -> in-memory webshell implant (w3wp.exe)
3a55d8f8f29716c694671834d8c6cb29  # Velociraptor.exe -> C:\ProgramFiles\Velociraptor\, v0.73.4.0 (CVE-2025-6264)
991ec6e04413f2d4d29341c17a8a54d5  # VS Code -> legitimate VS Code abused for tunneling
3d553b9061c03f891ce97d7d2e64ddee  # VS Code Insiders -> legitimate VS Code Insiders used for tunneling
2c32e44a013cbfc5a323efb7694701d2  # cloudflared tunneling executable -> legitimate tunneling tool abused
112a86eca3cb5a0b5e20ab744cc5af93  # 7z.exe -> renamed 7-Zip used for sideloading
a930f81e3fb0a226ec5904d9043a17b8  # ZohoMeeting.7z -> C:\ProgramFiles(x86)\ZohoMeeting\UnAttended\
054a32d6033b1744dca7f49b2e466ea2  # rsndispot.sys -> C:\programdata\, vulnerable driver for EDR killing
2d9ebf9c042f596f435865b40edad928  # Warlock AV-killer DLL -> sideloaded

SHA1s
(not available)  # vskp2 -> in-memory webshell implant (w3wp.exe)
(not available)  # Velociraptor.exe -> C:\ProgramFiles\Velociraptor\, v0.73.4.0 (CVE-2025-6264)
(not available)  # VS Code -> legitimate VS Code abused for tunneling
(not available)  # VS Code Insiders -> legitimate VS Code Insiders used for tunneling
(not available)  # cloudflared tunneling executable -> legitimate tunneling tool abused
(not available)  # 7z.exe -> renamed 7-Zip used for sideloading
(not available)  # ZohoMeeting.7z -> C:\ProgramFiles(x86)\ZohoMeeting\UnAttended\
(not available)  # rsndispot.sys -> C:\programdata\, vulnerable driver for EDR killing
(not available)  # Warlock AV-killer DLL -> sideloaded

SHA256s
(not available)  # vskp2 -> in-memory webshell implant (w3wp.exe)
(not available)  # Velociraptor.exe -> C:\ProgramFiles\Velociraptor\, v0.73.4.0 (CVE-2025-6264)
(not available)  # VS Code -> legitimate VS Code abused for tunneling
(not available)  # VS Code Insiders -> legitimate VS Code Insiders used for tunneling
(not available)  # cloudflared tunneling executable -> legitimate tunneling tool abused
(not available)  # 7z.exe -> renamed 7-Zip used for sideloading
(not available)  # ZohoMeeting.7z -> C:\ProgramFiles(x86)\ZohoMeeting\UnAttended\
(not available)  # rsndispot.sys -> C:\programdata\, vulnerable driver for EDR killing
(not available)  # Warlock AV-killer DLL -> sideloaded

References Appendix

• “How to detect fileless attacks exploiting ToolShell: analyzing the Storm-2603 incident” (The SOC Files 5), Kaspersky Securelist, Nov. 5, 2026, https://securelist.com/storm-2603-fileless-toolshell-attack/121467/ (source article; timeline, implant analysis, detection guidance, attribution and indicators)
• CLRDeserializationExploitFinder, Kaspersky researcher repository on GitHub, https://github.com/gam4er/CLRDeserializationExploitFinder (detection tool referenced by the source article)
• VirtualPathProvider Lab, Kaspersky researcher repository on GitHub, https://github.com/gam4er/WebApplication (detection lab referenced by the source article)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/