"The payload was not written to disk; rather, it was loaded directly into the ASP.NET runtime and used during subsequent request processing," Kaspersky wrote, describing an attack that left the primary bridge entirely in memory.
Timeline: fingerprinting on Dec 20, full RCE on Dec 24
Kaspersky’s analysis reconstructs a two-stage intrusion against an on-premises Microsoft SharePoint server in December 2025. On Dec 20 an active fingerprinting request targeted a SharePoint ToolPane administrative endpoint using ONYPHE infrastructure to validate vulnerability to CVE-2025-53770. After three days of silence (Dec 21–23), the actor re‑engaged on Dec 24 and executed a remote code execution (RCE) chain through the IIS worker process (w3wp.exe). The incident was discovered on Dec 26; retrospective correlation linked the initial probe to the later exploitation.
The in-memory webshell: architecture and capabilities
The implant was an in-memory, modular C# framework that registered a VirtualPathProvider (VPP) inside the ASP.NET HostingEnvironment to serve virtual content without files. The main orchestrator, G.cs, hooked into GetCacheKey() to inspect request headers for a specific User-Agent and, when triggered, used an XOR-obfuscated binary protocol to exchange C2 data. The webshell established bidirectional TCP proxying and stored active sockets in memory to support pivoting through the SharePoint host. Key components included Prog.cs as an entry point, uk/London.cs for command parsing and privilege escalation, and utility modules such as FileDownloader.cs, ProcessList.cs, NetworkInfo.cs, and MSI.cs.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildPost‑exploit tooling, escalation, and failed ransomware
Shortly after the in-memory implant executed, the compromised w3wp.exe spawned msiexec.exe to install an MSI hosted on Supabase: Velociraptor version 0.73.4.0 (noted as vulnerable to CVE-2025-6264). Kaspersky observed Velociraptor used for persistence, discovery, data collection and to deploy multiple independent tunneling mechanisms (Zoho Assist Unattended Support, VS Code CLI tunneling, Cloudflare Tunnel and a reverse proxy utility). The actor also uploaded a vulnerable driver (identified at C:\programdata\rsndispot.sys, hash 054a32d6033b1744dca7f49b2e466ea2) and used a malicious DLL identified as Warlock ransomware’s AV killer. Attempts to launch Warlock ransomware were blocked by the Proactive Defense Module in Kaspersky Endpoint Security.
Detection signals: deserialization artifacts and VirtualPathProvider traces
Kaspersky emphasizes two high‑value telemetry patterns. First, unsafe CLR deserialization activity typically generates helper assemblies and loader events; indicators in this case included Microsoft.GeneratedCode and App_Web_toolpane.aspx* appearing in the same application domain and strings linked to ObjectDataProvider, ExpandedWrapper and LosFormatter. Kaspersky recommends focusing on CLR loader events, memory and metadata inspection, and tooling such as CLRDeserializationExploitFinder to surface gadget-chain artifacts.
Second, VPP‑based runtime implants create a discrepancy between IIS/ASP.NET configuration resolution and the filesystem. The Microsoft‑Windows‑IIS‑Configuration ETW provider events 25 and 47 will map a virtual path to a physical path while file‑change events (17, 18, 19 and 21) are absent or inconsistent for that path. Kaspersky’s VirtualPathProvider Lab demonstrates this pattern and the vendor advises treating unexpected VirtualPathProvider registrations as anomalous.
What this means for security teams, enterprise IT, and incident responders
- Security teams and technologists: monitor w3wp.exe runtime behavior and outbound connections, instrument CLR loader events and IIS ETW (events 25/47 and 17–21), and deploy memory‑first detection such as CLRDeserializationExploitFinder and VirtualPathProvider Lab techniques.
- Enterprise IT and procurement: expect attacks that do not rely on disk artifacts — inventory legitimate VirtualPathProvider usage, ensure MachineKey and credential rotation following a confirmed SharePoint exploit, and treat a SharePoint RCE as a host‑level containment event rather than a narrow web remediation.
- Incident responders: preserve memory and IIS telemetry early, correlate low‑signal reconnaissance (for example ONYPHE probes) with later privileged activity, and reconstruct execution chains across application, host, and identity layers as part of TTP‑driven investigation.
Attribution: Microsoft has tracked Storm‑2603 as a standalone actor and Microsoft and Kaspersky link similar SharePoint exploitation and ransomware activity to Storm‑2603; Kaspersky assesses the ToolShell case as attributable to Storm‑2603 with moderate confidence. The operational lesson is concrete: internet‑facing SharePoint can deliver fileless, in‑memory code execution that bypasses file‑centric hunting and requires runtime and telemetry‑driven detection and response.
Original report: https://securelist.com/storm-2603-fileless-toolshell-attack/121467/
