Storm-2603 Hackers Exploit SharePoint ToolShell Flaws to Hide Fileless Backdoor and Launch Ransomware Attack
Storm-2603 hackers exploit SharePoint ToolShell flaws to deploy fileless backdoor and attempt ransomware.
Run Microsoft?
Get an email when a reviewed story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A China-linked threat group, Storm-2603, has exploited vulnerabilities in Microsoft SharePoint's ToolShell (CVE-2025-53770, CVE-2025-53771) to deploy a fileless backdoor. The attackers then attempted to deploy Warlock ransomware on the compromised network, though this was ultimately blocked by security software. The group used the backdoor to maintain persistence within the IIS worker process and leverage tools like Velociraptor for further network access and data exfiltration.
The lesson from this incident
Full lessonStorm-2603 exploited two critical SharePoint ToolShell vulnerabilities (CVE-2025-53770 and CVE-2025-53771) to gain initial access and implant a fileless backdoor inside the IIS worker process, making detection significantly harder than traditional file-based malware. The attackers leveraged legitimate tools like Velociraptor for lateral movement and data exfiltration before attempting to detonate Warlock ransomware. This incident demonstrates how unpatched internet-facing applications remain one of the most reliable entry points for sophisticated threat actors, including nation-state groups. The fileless nature of the backdoor underscores why timely patching must be paired with robust behavioral monitoring, as signature-based defenses alone may miss memory-resident threats.
What helps against this
How we list vendors
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
Indicators of Compromise
- cve — CVE-2025-53770
- cve — CVE-2025-53771
- ip — 45.91.94[.]204
- cve — CVE-2025-6264