Kaspersky Details Storm-2603’s Fileless ToolShell Intrusion and Detection Clues

Nov 5, 2026 · Original article ↗

Summary

Kaspersky analyzes a Storm-2603-attributed ToolShell intrusion using an in-memory SharePoint webshell, Velociraptor and tunneling tools. Kaspersky says its endpoint protection blocked a Warlock ransomware launch attempt and details runtime detection clues.

Key points

Kaspersky retrospectively linked December activity to Storm-2603 with moderate confidence, citing ToolShell exploitation and post-exploitation behavior consistent with other documented intrusions.
The attackers loaded a webshell into SharePoint’s IIS worker process, w3wp.exe, without writing the implant to disk; it used a custom HTTP-based channel and supported tunneling into the target network.
The analysis describes the webshell’s VirtualPathProvider-based runtime persistence and an EFSRPC named-pipe impersonation technique to obtain SYSTEM privileges.
After the webshell was injected, the worker process launched a Velociraptor MSI payload; attackers also deployed tunneling and remote-access tools to maintain access.
Kaspersky identified a vulnerable-driver and DLL-sideloading attempt associated with disabling endpoint defenses. It says Kaspersky Endpoint Security blocked the attempted Warlock ransomware launch.
For detection, the article recommends correlating ToolPane activity with CLR assembly and deserialization artifacts, and looking for IIS virtual-path mappings without corresponding files or normal file-change events.
The article advises correlating low-signal reconnaissance with later privileged activity and investigating anomalous w3wp.exe behavior, outbound connections, RPC coercion, and remote-management tools.

Article Details

Attack Vectors: The actor exploited ToolShell vulnerabilities CVE-2025-53770 and CVE-2025-53771 in on-premises SharePoint using crafted HTTP requests, resulting in code execution in w3wp.exe.
A memory-resident webshell in the IIS worker process intercepted HTTP requests matching a specific User-Agent and used a custom XOR-obfuscated protocol for command and control.
The webshell established a TCP proxy tunnel through the compromised SharePoint host to reach arbitrary hosts inside the target network.
The actor used EFSRPC named-pipe impersonation to obtain the LSASS.exe token and spawn a process with SYSTEM privileges.
Post-exploitation activity included downloading and installing a remote MSI containing Velociraptor, deploying tunneling and remote-access software, and attempting to disable EDR with a vulnerable driver and a sideloaded DLL.
Defensive Notes: Correlate low-signal vulnerability probes with later activity across application, host, and identity telemetry; the report describes a three-day gap between fingerprinting and exploitation.
Investigate anomalous w3wp.exe activity, unexpected outbound connections, RPC coercion, token impersonation, and newly introduced remote-management or DFIR tools.
For suspected ToolShell exploitation, correlate CLR loader events and generated assemblies such as Microsoft.GeneratedCode and App_Web_toolpane.aspx* with dangerous deserialization-related types including ObjectDataProvider, ExpandedWrapper, and LosFormatter; these indicators are not significant in isolation.
Monitor IIS Configuration ETW events 25 and 47 for virtual-path mappings that do not correspond to files on disk, and check whether expected FileChangeNotificationMonitor events 17, 18, 19, and 21 are absent for the same path.
Inventory legitimate VirtualPathProvider implementations and investigate unrecognized registrations; preserve memory and IIS telemetry and verify virtual resources against the filesystem.
After confirmed SharePoint exploit code execution, the article recommends host-level containment, persistence hunting, credential and exposed MachineKey rotation, and investigation beyond the initial exploit.

Indicators of compromise

Type	Indicator	Context
IPV4	`199[.]232[.]210[.]172`	Listed as a C2 traffic relay associated with the activity.
IPV4	`204[.]76[.]203[.]219`	Listed as a bulletproof-hosted C2 server.
IPV4	`45[.]91[.]94[.]204`	Observed source IP for the crafted SharePoint exploitation request; the article identifies it as an SPN node.
IPV4	`91[.]224[.]92[.]121`	Listed as a bulletproof-hosted C2 server.
MD5	`2d9ebf9c042f596f435865b40edad928`	Hash of the malicious DLL identified as Warlock ransomware’s AV killer and used in a sideloading attack.
URL	`hxxps[:]//auth[.]qgtxtebl[.]workers[.]dev/`	Listed as the Velociraptor server URL associated with the intrusion.
URL	`hxxps[:]//files[.]catbox[.]moe/8f7vex[.]msi`	Specific download URL for the Zoho Assist Unattended Agent used in the intrusion.
URL	`hxxps[:]//github[.]com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64[.]msi`	Specific download URL for a legitimate tunneling tool abused in the intrusion.
URL	`hxxps[:]//vdfccjpnedujhrzscjtq[.]supabase[.]co/storage/v1/object/public/image/v4[.]msi`	Specific cloud-hosted URL for the vulnerable Velociraptor MSI payload used in the intrusion.