A threat group tracked as Storm-2603 broke into an organization’s on-premises Microsoft SharePoint server, installed a backdoor that lived only in memory, and tried to finish the job with Warlock ransomware. Security researchers at Kaspersky’s Securelist team say the ransomware payload was caught and blocked before it could touch a single file — but the intrusion itself ran for days without anyone noticing.

The attackers got in through ToolShell, the collective name for a group of SharePoint vulnerabilities including CVE-2025-53770 and CVE-2025-53771, which let an attacker execute code on a server using nothing more than a specially built web request. Microsoft patched the bugs in mid-2025, and the incident is a reminder that patched vulnerabilities keep paying off for attackers as long as unpatched servers remain exposed.

A quiet reconnaissance, then a holiday-week strike

According to Securelist, the first probe against the target arrived from infrastructure linked to the scanning platform ONYPHE, simply checking whether the server was vulnerable. A second connection followed about twelve minutes later from a bulletproof hosting provider. Then, oddly, nothing happened for three days — long enough that the activity was initially logged as low priority.

The real attack landed later, timed to a stretch when security teams traditionally run short-staffed. A request routed through a privacy-focused relay network loaded a web shell directly into SharePoint’s IIS worker process, meaning it existed only in memory and would vanish the moment the server’s application pool restarted.

A modular toolkit built to stay invisible

Researchers describe the web shell as a modular framework written in C#. Its core component registered a custom handler that let the server respond to pages that technically did not exist as files on disk, and it only activated when a request carried a specific, attacker-chosen header — meaning ordinary traffic never triggered it. Communication back to the attackers ran over a custom protocol scrambled with simple XOR encoding, and a tunneling tool let the intruders pivot from the SharePoint box into the rest of the network.

• Separate modules enumerated running processes, logged-in users, and active network connections
• One module silently installed software packages; another created administrator accounts using low-level system calls that bypass normal command logging
• A known credential-theft technique exploited a privilege held by IIS worker processes to escalate to full system rights

Legitimate forensics tool turned persistence mechanism

Shortly after gaining a foothold, the attackers installed a real, publicly available forensics and incident-response tool — version 0.73.4.0, carrying its own known flaw — from cloud storage. Rather than use it to investigate anything, they used it to dig in: setting up several independent backup access routes, including remote-support software, a code-editor tunneling feature, and a reverse proxy, so that killing any single one of them would not cut off their access.

With multiple ways back in secured, the group stopped relying on the original web shell or even the SharePoint bug itself. They then dropped a vulnerable signed driver specifically to disable endpoint protection software, clearing the way for a side-loaded component Securelist links to Warlock ransomware’s defense-evasion routine. That is where the operation stalled: a proactive defense module intercepted and blocked the ransomware process before encryption began.

What this means for defenders

Securelist attributes the intrusion to Storm-2603 with moderate confidence, based on the ToolShell exploitation pattern, the specific ransomware tooling involved, and the group’s established habit of abusing the same forensics utility for persistence. The case underlines a point that keeps recurring in enterprise security: patching a vulnerability closes the door for future attacks, but it does nothing for servers that were already compromised beforehand or that never got the update.

Organizations running on-premises SharePoint are urged to apply Microsoft’s emergency security updates if they have not already, rotate any cryptographic machine keys that may have been exposed, and actively hunt for signs of lingering access rather than assuming a clean bill of health. Red flags include unusual behavior from the IIS worker process, unexpected outbound connections to remote-management or tunneling services, and the presence of forensics or administration tools that were never deployed by IT. Given how long attackers can sit quietly inside a compromised server, Securelist recommends treating any confirmed exploitation of these flaws as a full compromise of the host, not just the web application layer.