[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fy6R-6ftsf4MIgRE8rGzUsWQPPqMl7_CXaFTB05HWs9I":3},{"article":4,"iocs":57,"watch_terms":71,"solutions":72,"lesson":167},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"f8fa68cc-7970-4e3f-a75e-ed7da698e4ad","Storm-2603 Hackers Exploit SharePoint ToolShell Flaws to Hide Fileless Backdoor and Launch Ransomware Attack","storm-2603-hackers-exploit-sharepoint-toolshell-flaws-to-hide-fileless-backdoor-b1e1da","A China-linked threat group tracked as Storm-2603 has used the SharePoint ToolShell flaws to plant a backdoor that never touches the disk. The group then tried to run Warlock ransomware on the same network. The break-in hit an on-premises SharePoint server and ended with a ransomware launch that security software blocked. ToolShell is the name […] The post Storm-2603 Hackers Exploit SharePoint ToolShell Flaws to Hide Fileless Backdoor and Launch Ransomware Attack appeared first on Cyber Security News.","A China-linked threat group, Storm-2603, has exploited vulnerabilities in Microsoft SharePoint's ToolShell (CVE-2025-53770, CVE-2025-53771) to deploy a fileless backdoor. The attackers then attempted to deploy Warlock ransomware on the compromised network, though this was ultimately blocked by security software. The group used the backdoor to maintain persistence within the IIS worker process and leverage tools like Velociraptor for further network access and data exfiltration.","Storm-2603 hackers exploit SharePoint ToolShell flaws to deploy fileless backdoor and attempt ransomware.","https:\u002F\u002Fcybersecuritynews.com\u002Fstorm-2603-hackers\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FStorm-2603-Hackers-Exploit-SharePoint-ToolShell-Flaws-to-Hide-Fileless-Backdoor-and-Launch-Ransomware-Attack.webp","2026-11-06T11:43:01+00:00","2026-11-06T12:00:28.167601+00:00",9,[17,20,23,25,28],{"name":18,"type":19},"Storm-2603","threat_actor",{"name":21,"type":22},"SharePoint ToolShell","product",{"name":24,"type":22},"Velociraptor",{"name":26,"type":27},"Microsoft","vendor",{"name":29,"type":30},"IIS worker process","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":53},{"id":54,"icon":33,"name":55,"slug":56},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[58,62,64,68],{"type":59,"value":60,"context":61},"cve","CVE-2025-53770","SharePoint ToolShell vulnerability used for initial access.",{"type":59,"value":63,"context":61},"CVE-2025-53771",{"type":65,"value":66,"context":67},"ip","45.91.94[.]204","IP address used for initial crafted request to exploit SharePoint.",{"type":59,"value":69,"context":70},"CVE-2025-6264","Vulnerability in Velociraptor, a forensics tool used by the attackers for persistence.",[26,21,24],{"controls":73,"vendors":161},[74,103,132],{"slug":75,"name":76,"problem":77,"products":78},"patch-management","Automated patch management","Known holes get closed in days, not months.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":104,"name":105,"problem":106,"products":107},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[108,116,124],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":133,"name":134,"problem":135,"products":136},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[137,145,153],{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":154,"vendor_name":155,"vendor_logo":156,"product_slug":157,"product_name":158,"url":159,"description":160},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",[162],{"slug":163,"name":26,"logo_path":164,"roles":165},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[166],"affected",{"slug":168,"title":169,"body":170,"framework_refs":171,"framework_notes":179},"china-linked-storm-2603-exploits-unpatched-sharepoint-flaws-to-deploy-fileless-backdoor-and-ransomwa","China-Linked Storm-2603 Exploits Unpatched SharePoint Flaws to Deploy Fileless Backdoor and Ransomware","Storm-2603 exploited two critical SharePoint ToolShell vulnerabilities (CVE-2025-53770 and CVE-2025-53771) to gain initial access and implant a fileless backdoor inside the IIS worker process, making detection significantly harder than traditional file-based malware. The attackers leveraged legitimate tools like Velociraptor for lateral movement and data exfiltration before attempting to detonate Warlock ransomware. This incident demonstrates how unpatched internet-facing applications remain one of the most reliable entry points for sophisticated threat actors, including nation-state groups. The fileless nature of the backdoor underscores why timely patching must be paired with robust behavioral monitoring, as signature-based defenses alone may miss memory-resident threats.",[172,173,174,175,176,177,178],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","MITRE ATT&CK T1566: Phishing","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":180,"MITRE ATT&CK T1566: Phishing":181,"NIST SP 800-53 SI-2: Flaw Remediation":182,"CIS Control 17: Incident Response Management":183,"OWASP A06:2021 Vulnerable and Outdated Components":184,"CIS Control 7: Continuous Vulnerability Management":185,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":186},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices; the delayed patching of critical SharePoint flaws represents a gap in the technical measures mandated by this article.","While initial access here was via web exploitation rather than phishing, Storm-2603's subsequent use of living-off-the-land tools and fileless techniques aligns with MITRE ATT&CK sub-techniques for defense evasion and persistence that defenders should map detections against.","SI-2 requires organizations to identify, report, and correct information system flaws on a schedule commensurate with risk — a process that, if followed, would have prioritized patching CVE-2025-53770 and CVE-2025-53771 before exploitation occurred.","The attackers maintained persistence and progressed to ransomware deployment, highlighting the need for a mature incident response plan that includes playbooks for fileless malware and nation-state intrusions to contain threats before they escalate.","The SharePoint ToolShell exploitation maps directly to this risk category, as the compromise stemmed from running a component with known, unpatched critical vulnerabilities exposed to the internet.","Routine vulnerability scanning and a defined patch deadline for critical internet-facing systems would have ensured the SharePoint ToolShell flaws were remediated before Storm-2603 could exploit them.","This control mandates timely identification and remediation of technical vulnerabilities in internet-facing systems, which directly addresses the failure to patch the exploited SharePoint flaws in time."]