securelist · Crawled Nov 7, 2026

The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603

24 IoCs 1 Actors 1 Malware 1 CVEs
Read original article ↗

AI Summary

In December 2025, threat actor Storm-2603 exploited CVE-2025-53770 and CVE-2025-53771 (ToolShell vulnerabilities) in on-premises Microsoft SharePoint to achieve remote code execution, deploying a fileless webshell within the IIS worker process (w3wp.exe). The attack used in-memory execution via a VirtualPathProvider-based implant to maintain persistence without writing to disk, enabling command and control, lateral movement, and data exfiltration. The actor deployed Velociraptor for post-compromise operations, attempted to deploy Warlock ransomware, and used EDR-killing techniques, but was partially blocked by security controls.

AI-extracted · verify before operational use

Extracted Entities 3 found

Threat Actor Storm-2603 → Malware WarLock → CVE CVE-2025-6264 →

Indicators of Compromise 24 extracted

Type Value Detail
IP 45[.]91[.]94[.]204 Details →
IP 199[.]232[.]210[.]172 Details →
IP 91[.]224[.]92[.]121 Details →
IP 49[.]51[.]132[.]100 Details →
IP 204[.]76[.]203[.]219 Details →
Domain vdfccjpnedujhrzscjtq[.]supabase[.]co Details →
Domain auth[.]qgtxtebl[.]workers[.]dev Details →
Domain files[.]catbox[.]moe Details →
Filename C:\programdata\rsndispot.sys Details →
Filename C:\ProgramFiles\Velociraptor\Velociraptor.exe Details →
Filename C:\ProgramFiles(x86)\ZohoMeeting\UnAttended\ZohoMeeting.7z Details →
Filename 7z.exe Details →
MD5 2d9ebf9c042f596f435865b40edad928 Details →
MD5 054a32d6033b1744dca7f49b2e466ea2 Details →
MD5 112a86eca3cb5a0b5e20ab744cc5af93 Details →
MD5 0fd91321bf7ff7245dda9b7b5d791ace8 Details →
MD5 3a55d8f8f29716c694671834d8c6cb29 Details →
MD5 991ec6e04413f2d4d29341c17a8a54d5 Details →
MD5 3d553b9061c03f891ce97d7d2e64ddee Details →
MD5 2c32e44a013cbfc5a323efb7694701d2 Details →
MD5 a930f81e3fb0a226ec5904d9043a17b8 Details →
Package https://vdfccjpnedujhrzscjtq.supabase.co/storage/v1/object/public/image/v4.msi Details →
Package https://files.catbox.moe/8f7vex.msi Details →
Package https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.msi Details →

MITRE ATT&CK TTPs 47 techniques

T1003.001 LSASS Memory · Credential Access T1018 Remote System Discovery · Discovery T1021 Remote Services · Lateral Movement T1021.001 Remote Desktop Protocol · Lateral Movement T1021.004 SSH · Lateral Movement T1046 Network Service Discovery · Discovery T1048 Exfiltration Over Alternative Protocol · Exfiltration T1053 Scheduled Task/Job · Execution T1055 Process Injection · Defense Evasion T1055.001 Dynamic-link Library Injection · Defense Evasion T1059.001 PowerShell · Execution T1059.003 Windows Command Shell · Execution T1069 Permission Groups Discovery · Discovery T1070 Indicator Removal · Defense Evasion T1070.004 File Deletion · Defense Evasion T1071.001 Web Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1087 Account Discovery · Discovery T1087.002 Domain Account · Discovery T1090 Proxy · Command And Control T1102 Web Service · Command And Control T1105 Ingress Tool Transfer · Command And Control T1110.003 Password Spraying · Credential Access T1111 Multi-Factor Authentication Interception · Credential Access T1133 External Remote Services · Persistence T1190 Exploit Public-Facing Application · Initial Access T1204.001 Malicious Link · Execution T1210 Exploitation of Remote Services · Lateral Movement T1218.001 Compiled HTML File · Defense Evasion T1219 Remote Access Software · Command And Control T1484 Domain or Tenant Policy Modification · Defense Evasion T1485 Data Destruction · Impact T1486 Data Encrypted for Impact · Impact T1526 Cloud Service Discovery · Discovery T1534 Internal Spearphishing · Lateral Movement T1543.003 Windows Service · Persistence T1553 Subvert Trust Controls · Defense Evasion T1558 Steal or Forge Kerberos Tickets · Credential Access T1564.008 Email Hiding Rules · Defense Evasion T1566 Phishing · Initial Access T1567 Exfiltration Over Web Service · Exfiltration T1572 Protocol Tunneling · Command And Control T1621 Multi-Factor Authentication Request Generation · Credential Access T1663 T1663 T1687 T1687