China-Linked Storm-2603 Exploits Unpatched SharePoint Flaws to Deploy Fileless Backdoor and Ransomware
Storm-2603 exploited two critical SharePoint ToolShell vulnerabilities (CVE-2025-53770 and CVE-2025-53771) to gain initial access and implant a fileless backdoor inside the IIS worker process, making detection significantly harder than traditional file-based malware. The attackers leveraged legitimate tools like Velociraptor for lateral movement and data exfiltration before attempting to detonate Warlock ransomware. This incident demonstrates how unpatched internet-facing applications remain one of the most reliable entry points for sophisticated threat actors, including nation-state groups. The fileless nature of the backdoor underscores why timely patching must be paired with robust behavioral monitoring, as signature-based defenses alone may miss memory-resident threats.
Tactical Insight
Immediate actions
- Apply Microsoft's emergency patches for CVE-2025-53770 and CVE-2025-53771 to all SharePoint instances without delay.
- Temporarily restrict or place internet-facing SharePoint servers behind a WAF or VPN while patches are being validated and deployed.
- Run a threat hunt across IIS worker processes and memory for indicators of compromise associated with Storm-2603 and fileless backdoor techniques.
Long-term improvements
- Establish a formal emergency patching SLA (e.g., 24–48 hours for critical/internet-facing CVEs) backed by an automated patch deployment pipeline.
- Maintain a continuously updated inventory of all internet-exposed assets and their patch status to reduce blind spots during zero-day events.
- Implement network segmentation so that compromised SharePoint servers cannot directly reach internal systems, domain controllers, or backup infrastructure.
Detection measures
- Deploy endpoint detection and response (EDR) solutions with memory scanning and behavioral analytics to identify fileless malware running within legitimate processes like IIS.
- Enable detailed logging of IIS worker process activity, PowerShell execution, and lateral movement tools, and forward logs to a SIEM with alerting rules for anomalous behavior.
- Integrate threat intelligence feeds covering nation-state TTPs to receive early warning when known groups begin exploiting new SharePoint or Microsoft vulnerabilities.