A China-linked hacking group turned a Microsoft SharePoint server into a backdoor that existed only in memory, according to a new Kaspersky report — and then tried to finish the job with ransomware. The intrusion, attributed to the group Microsoft tracks as Storm-2603, used the SharePoint flaws known as ToolShell to load a webshell directly into the server's IIS worker process, leaving nothing on disk for defenders to find.
Kaspersky's Securelist team published its account of the attack on November 5, 2026, in the latest instalment of its "SOC Files" series. The researchers describe a patient, two-stage break-in: a single probe on December 20 to check whether the server was vulnerable, three quiet days, then a full remote-code-execution attack on December 24 — Christmas Eve, when many security teams run on skeleton staffing. Kaspersky only spotted the intrusion on December 26, during retrospective analysis.
A backdoor that lives only in memory
The attackers exploited ToolShell, a chain of SharePoint flaws built around CVE-2025-53770 and CVE-2025-53771, which bypass earlier patches for CVE-2025-49704 and CVE-2025-49706. The exploit was delivered through the SharePoint ToolPane endpoint, and the payload was a fileless webshell injected straight into w3wp.exe, the IIS worker process that serves SharePoint requests.
Because the implant ran entirely in memory, it survived the usual file-based detection: there was no webshell file to scan, quarantine or hash. It communicated with its operators over a custom binary protocol with XOR obfuscation, and built a TCP tunnel with the suo5 proxy tool so the attackers could reach other machines inside the network through the compromised SharePoint host.
Tunnels stacked on tunnels
Once inside, the group layered backup access routes so it could stay connected even if the original foothold was removed. Through Velociraptor — a legitimate open-source forensics tool, version 0.73.4.0, which itself carries a known flaw, CVE-2025-6264 — the attackers installed Zoho Assist, set up VS Code tunnelling, deployed Cloudflare Tunnel and added a small reverse proxy.
The operation then escalated toward ransomware. The attackers tried to disable endpoint defences using vulnerable drivers and attempted to launch Warlock ransomware on the network. Kaspersky says its Proactive Defense Module blocked the ransomware process before it could encrypt anything, ending the intrusion there.
Microsoft has previously linked Storm-2603 to Warlock and LockBit 3.0 ransomware attacks that followed ToolShell exploitation in July 2025, including theft of SharePoint MachineKeys. Kaspersky attributes this incident to the group with moderate confidence, based on the ToolShell use, the Warlock tooling and the Velociraptor habits. The victim's sector and region were not disclosed.
What defenders should do now
The report is a warning that patching alone may not be enough. Kaspersky and Microsoft both advise organisations running on-premises SharePoint to install the latest emergency security updates, rotate exposed ASP.NET MachineKeys and restart IIS — and then hunt for persistence that patching cannot remove.
Defenders should look for IIS configuration events that map to a path with no file on disk, check for unapproved VirtualPathProvider instances, and enable AMSI in full mode alongside endpoint protection. The message of the case is blunt: unpatched SharePoint servers were still being hit months after the July 2025 patches, and a fileless implant can keep a door open long after the vulnerability that created it has been closed.
