[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWDtVZIOXuMB-21uZ6eGgV6qCR4ygakdjMrs36t3r6IQ":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":54},"1cdce3d0-03de-40a0-b91d-84b6565e3f0b","china-linked-storm-2603-exploits-unpatched-sharepoint-flaws-to-deploy-fileless-backdoor-and-ransomwa","f8fa68cc-7970-4e3f-a75e-ed7da698e4ad","China-Linked Storm-2603 Exploits Unpatched SharePoint Flaws to Deploy Fileless Backdoor and Ransomware","Storm-2603 exploited two critical SharePoint ToolShell vulnerabilities (CVE-2025-53770 and CVE-2025-53771) to gain initial access and implant a fileless backdoor inside the IIS worker process, making detection significantly harder than traditional file-based malware. The attackers leveraged legitimate tools like Velociraptor for lateral movement and data exfiltration before attempting to detonate Warlock ransomware. This incident demonstrates how unpatched internet-facing applications remain one of the most reliable entry points for sophisticated threat actors, including nation-state groups. The fileless nature of the backdoor underscores why timely patching must be paired with robust behavioral monitoring, as signature-based defenses alone may miss memory-resident threats.","**Immediate actions:**\n- Apply Microsoft's emergency patches for CVE-2025-53770 and CVE-2025-53771 to all SharePoint instances without delay.\n- Temporarily restrict or place internet-facing SharePoint servers behind a WAF or VPN while patches are being validated and deployed.\n- Run a threat hunt across IIS worker processes and memory for indicators of compromise associated with Storm-2603 and fileless backdoor techniques.\n\n**Long-term improvements:**\n- Establish a formal emergency patching SLA (e.g., 24–48 hours for critical\u002Finternet-facing CVEs) backed by an automated patch deployment pipeline.\n- Maintain a continuously updated inventory of all internet-exposed assets and their patch status to reduce blind spots during zero-day events.\n- Implement network segmentation so that compromised SharePoint servers cannot directly reach internal systems, domain controllers, or backup infrastructure.\n\n**Detection measures:**\n- Deploy endpoint detection and response (EDR) solutions with memory scanning and behavioral analytics to identify fileless malware running within legitimate processes like IIS.\n- Enable detailed logging of IIS worker process activity, PowerShell execution, and lateral movement tools, and forward logs to a SIEM with alerting rules for anomalous behavior.\n- Integrate threat intelligence feeds covering nation-state TTPs to receive early warning when known groups begin exploiting new SharePoint or Microsoft vulnerabilities.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","MITRE ATT&CK T1566: Phishing","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1566: Phishing":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"CIS Control 17: Incident Response Management":23,"OWASP A06:2021 Vulnerable and Outdated Components":24,"CIS Control 7: Continuous Vulnerability Management":25,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":26},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices; the delayed patching of critical SharePoint flaws represents a gap in the technical measures mandated by this article.","While initial access here was via web exploitation rather than phishing, Storm-2603's subsequent use of living-off-the-land tools and fileless techniques aligns with MITRE ATT&CK sub-techniques for defense evasion and persistence that defenders should map detections against.","SI-2 requires organizations to identify, report, and correct information system flaws on a schedule commensurate with risk — a process that, if followed, would have prioritized patching CVE-2025-53770 and CVE-2025-53771 before exploitation occurred.","The attackers maintained persistence and progressed to ransomware deployment, highlighting the need for a mature incident response plan that includes playbooks for fileless malware and nation-state intrusions to contain threats before they escalate.","The SharePoint ToolShell exploitation maps directly to this risk category, as the compromise stemmed from running a component with known, unpatched critical vulnerabilities exposed to the internet.","Routine vulnerability scanning and a defined patch deadline for critical internet-facing systems would have ensured the SharePoint ToolShell flaws were remediated before Storm-2603 could exploit them.","This control mandates timely identification and remediation of technical vulnerabilities in internet-facing systems, which directly addresses the failure to patch the exploited SharePoint flaws in time.","published","2026-11-06T12:20:23.82159+00:00","2026-11-06T12:20:23.805+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fcybersecuritynews.com\u002Fstorm-2603-hackers\u002F","storm-2603-hackers-exploit-sharepoint-toolshell-flaws-to-hide-fileless-backdoor-b1e1da","Storm-2603 Hackers Exploit SharePoint ToolShell Flaws to Hide Fileless Backdoor and Launch Ransomware Attack",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[48],{"id":49,"date":50,"edition":51,"title":52,"audio_url":53},"4219f8e8-b0dd-4e63-97e9-d697daac68c4","2026-11-06","afternoon","ThreatNoir Afternoon Brief — November 6","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-11-06\u002Fthreatnoir-afternoon-brief-2026-11-06.mp3",[55,58,62],{"slug":44,"name":56,"problem":57},"Automated patch management","Known holes get closed in days, not months.",{"slug":59,"name":60,"problem":61},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":63,"name":64,"problem":65},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen."]