The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603

In 2025, threat actors exploited CVE-2025-53770 and CVE-2025-53771 in on-premises Microsoft SharePoint to achieve remote code execution via crafted HTTP requests, a campaign Microsoft linked to Storm-2603. The intrusion began on Dec 20 with a vulnerability-fingerprinting request to the ToolPane component, originating from ONYPHE infrastructure. After a three-day tactical latency, the attacker launched a high-intensity re-engagement on Dec 24, delivering a fileless webshell—identified as “G.cs”—through the IIS worker process (w3wp.exe) from a Safing Privacy Network node (45.91.94.204). The payload lived only in memory, persisting for the application domain’s lifetime and evading disk-based detection, though later post-exploitation activity left disk artifacts. Subsequent analysis revealed EDR-killing attempts and a ransomware deployment attempt, with the in-memory bridge remaining the primary access channel. ¹