An attacker who broke into an on-premises Microsoft SharePoint server on Christmas Eve last year never wrote its main backdoor to disk. According to a new report from Kaspersky researchers Alexander Rodchenko and Rodrigo Wanderson, the intruder ran a multi-module webshell entirely inside the IIS worker process, used it as a bridge into the victim's network, and later tried to launch Warlock ransomware before Kaspersky's endpoint protection blocked it.
Kaspersky says the activity is consistent with the tactics of Storm-2603, the cluster Microsoft tied to ransomware deployment through the ToolShell SharePoint vulnerabilities (CVE-2025-53770 and CVE-2025-53771). Other actors that abused ToolShell mostly stole credentials or data. This one wanted to encrypt.
A probe, three quiet days, then the holiday strike
The timeline is the most instructive part of the report. On December 20 a single HTTP request checked whether the server's ToolPane endpoint was vulnerable. Kaspersky traced it to infrastructure belonging to ONYPHE, an attack surface scanning platform that actively tests whether a target is exploitable. About 12 minutes later a connection arrived from Pfcloud UG, a provider Kaspersky describes as running a bulletproof hosting model. Then nothing happened for three days.
On December 24, when many security teams run on skeleton staff, the full exploit chain landed from 45[.]91[.]94[.]204, a node of the Safing Privacy Network, a multi-hop VPN-style service that often slips past standard Tor blocklists. The incident was discovered on December 26. Because of the gap, the original probe had been treated as low priority and was only linked to the intrusion in hindsight.
A backdoor that lives only in memory
The implant was loaded straight into the ASP.NET runtime inside w3wp.exe and survived until the application pool recycled. Its core module hooked SharePoint's request handling and stayed dormant unless a request carried a specific User-Agent string, which made its traffic hard to pick out. It tunnelled the attacker's connections into the internal network using the open-source suo5 proxy tool, and bundled modules to list users, processes and network connections, download and silently install MSI packages, and create administrator accounts through the Windows SAM interface. To reach SYSTEM, it borrowed a trimmed-down version of the EfsPotato privilege-escalation technique.
From there the attacker installed an old Velociraptor build (0.73.4.0, vulnerable to CVE-2025-6264) hosted on a cloud storage bucket, then layered on several independent ways back in: Zoho Assist, VS Code CLI tunnelling, Cloudflare Tunnel and a small reverse proxy. Kaspersky also found a vulnerable driver dropped as rsndispot.sys and a DLL it identified as Warlock's antivirus killer, followed by the blocked ransomware launch. For more on how SharePoint attackers hold on after the patch is applied, see our earlier coverage and the Storm-2603 profile.
Hunt for deserialization artifacts, not files
Since the access layer leaves nothing on disk, Kaspersky recommends watching the .NET runtime. A ToolPane request that is immediately followed by the Microsoft.GeneratedCode helper assembly loading alongside App_Web_toolpane.aspx suggests the server is deserializing attacker-supplied data. Strings such as ObjectDataProvider, ExpandedWrapper and LosFormatter in memory or helper assemblies are strong signs of exploitation. Kaspersky has released a tool, CLRDeserializationExploitFinder, to look for these traces. Patch SharePoint and treat an isolated vulnerability probe as the possible start of an intrusion rather than background noise.
Indicators
- Exploit source: 45[.]91[.]94[.]204
- Payload URL: hxxps://vdfccjpnedujhrzscjtq[.]supabase[.]co/storage/v1/object/public/image/v4[.]msi
- Payload URL: hxxps://files[.]catbox[.]moe/8f7vex[.]msi
- Vulnerable driver rsndispot.sys (MD5): 054a32d6033b1744dca7f49b2e466ea2
- Warlock AV killer DLL (MD5): 2d9ebf9c042f596f435865b40edad928
The lesson is less about SharePoint than about patience: a scan nobody acted on became a ransomware attempt four days later.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.