Storm-2603 Exploits SharePoint for Fileless Ransomware Deployment
Threat actor Storm-2603 leveraged two critical Microsoft SharePoint vulnerabilities, CVE-2025-53770 and CVE-2025-53771, to achieve fileless remote code execution and deploy ransomware.
In late 2025, threat actor Storm-2603 executed a sophisticated attack against on-premises Microsoft SharePoint deployments, exploiting two critical vulnerabilities, CVE-2025-53770 and CVE-2025-53771, collectively known as the ToolShell vulnerabilities. These flaws allowed for remote code execution via specially crafted HTTP requests. Unlike many other threat actors who utilized these vulnerabilities for credential theft or espionage, Storm-2603's objective was to deploy ransomware.
The intrusion followed a strategic timeline, beginning with vulnerability fingerprinting on December 20th. The attacker used a tool associated with ONYPHE, an attack surface discovery platform, to probe a SharePoint administrative endpoint for the ToolPane component. This initial probe was designed to confirm the presence of the vulnerability without triggering immediate alarms. A three-day period of tactical latency followed, during which the attacker remained dormant, potentially to further evade detection before re-engaging.
On Christmas Eve, a period often characterized by reduced security staffing, the attacker initiated the full exploitation chain. The exploit was delivered through the IIS worker process (w3wp.exe), a core component of Microsoft's web server. This allowed the attacker to achieve remote code execution entirely in memory, without writing any malicious files to the disk. This fileless approach significantly complicates detection and forensic analysis, as traditional signature-based antivirus solutions may not identify the threat.
The initial access validation phase involved two distinct connections. The first, on December 20th, originated from infrastructure linked to ONYPHE, confirming the vulnerability. Approximately 12 minutes later, a second connection came from infrastructure associated with Pfcloud UG, a provider known for bulletproof hosting. While no exploitation occurred during this second connection, its timing and origin suggest it may have been follow-on reconnaissance against the newly identified target.
The active exploitation on December 24th originated from an IP address associated with the Safing Privacy Network (SPN), a privacy-focused VPN service that can obscure the true origin of traffic. The attacker leveraged this to deliver a webshell directly into the ASP.NET runtime within the w3wp.exe process. This in-memory implant remained active as long as the application domain was running, but would be lost upon an application pool recycle or IIS restart.
While the initial access and webshell remained memory-resident, subsequent post-exploitation activities did generate disk artifacts. The specific nature of these activities, leading to ransomware deployment, distinguishes Storm-2603's campaign from other threat actors who were observed using the same vulnerabilities for different objectives. Microsoft has attributed this specific ransomware activity to Storm-2603.
This attack highlights the persistent threat posed by unpatched vulnerabilities in widely used software like Microsoft SharePoint. The fileless nature of the exploit, combined with the use of privacy-enhancing network services to mask the attacker's origin, underscores the evolving tactics, techniques, and procedures (TTPs) employed by sophisticated threat actors.