Kaspersky reconstructs an intrusion through SharePoint ToolShell, attributed to Storm-2603 with moderate confidence, whose implant lived only inside w3wp.exe: an ASP.NET VirtualPathProvider memory shell with a suo5 tunnel, then Velociraptor, several tunnelling mechanisms and Warlock's AV killer
Storm-2603-linked SharePoint intrusion: memory-only VirtualPathProvider shell in w3wp.exe, then Velociraptor and tunnels
Analysis
Kaspersky's retrospective analysis of a December intrusion at a customer's on-premises SharePoint server found activity consistent with Storm-2603, with the access and control layer held entirely inside the IIS worker process w3wp.exe and nothing written to disk (Kaspersky, 2026-11-05). On December 20 a single request to a SharePoint administrative endpoint tied to the ToolPane component fingerprinted the host for ToolShell (CVE-2025-53770); the full exploit chain ran on December 24 against the same endpoint, and the gap kept the probe from being correlated with it (Kaspersky, 2026-11-05). The payload was loaded into the ASP.NET runtime and lost when the application pool recycled or IIS restarted (Kaspersky, 2026-11-05).
The memory shell registers a custom VirtualPathProvider through a non-public method of the ASP.NET HostingEnvironment class, subverts trust controls so that the registration works even in a precompiled application, intercepts requests at the GetCacheKey() hook and stays dormant unless a specific User-Agent header arrives (Kaspersky, 2026-11-05). It speaks a custom XOR-obfuscated binary protocol, and the open-source suo5 tool proxies traffic so connections from the command server reach arbitrary hosts inside the network through the SharePoint server (Kaspersky, 2026-11-05). It reaches SYSTEM by named-pipe token impersonation adapted from EfsPotato and creates administrative accounts through native SAM RPC calls (Kaspersky, 2026-11-05).
Shortly after the injection w3wp.exe started msiexec.exe to install a remote MSI that was Velociraptor 0.73.4.0, vulnerable to CVE-2025-6264, which the actor used for persistence, discovery, data collection and payload execution and to deploy Zoho Assist unattended access, a VS Code CLI tunnel, Cloudflare Tunnel and a reverse proxy, so access no longer depended on the IIS process (Kaspersky, 2026-11-05). The actor then uploaded a vulnerable driver that is used to terminate EDR products and sideloaded a DLL that Kaspersky identified as Warlock ransomware's AV killer, possibly meant to use that driver; Kaspersky's endpoint product blocked the ransomware process (Kaspersky, 2026-11-05).
Triage: App_Web_* assemblies come from ordinary ASP.NET page compilation and Microsoft.GeneratedCode from legitimate XmlSerializer use, so neither is a signal alone; the signal is the pair in one application domain right after a ToolPane request, and any VirtualPathProvider that is not on the application's inventory (Kaspersky, 2026-11-05). The December 20 probe came from infrastructure associated with ONYPHE, an attack-surface discovery platform whose vulnerability checks use non-intrusive probes, so a probe alone looks like a benign scanner; Kaspersky's retrospective analysis established the probe as the initial phase of the intrusion that followed on the same endpoint (Kaspersky, 2026-11-05).
Cited evidence
This activity involved the attacker using the IIS worker process as an in-memory bridge to the customer’s infrastructure, keeping the access and control layer entirely within w3wp.exe without writing anything to disk.
Consequently, the presence of positive events 25 and 47 combined with the absence of the expected events 17, 18, 19, and 21 for the same path forms a reliable detection pattern
this allows us to attribute this case to Storm-2603 with moderate confidence.
Sources1
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.