Date: 11/06/2026
Severity: High
Summary
Researchers analyzed a fileless SharePoint intrusion attributed with moderate confidence to Storm-2603, involving exploitation of ToolShell vulnerabilities CVE-2025-53770 and CVE-2025-53771 to achieve remote code execution. The threat actor injected an in-memory C# webshell into w3wp.exe, enabling covert Command-and-Control (C2), network tunneling, privilege escalation, and lateral movement without initially writing the implant to disk. Post-exploitation involved Velociraptor deployment, EDR-killing driver abuse, persistence through ASP.NET runtime manipulation, and attempted Warlock ransomware execution.
Indicators of Compromise (IOC) List
Domains/URLs | https://auth.qgtxtebl.workers.dev/ https://files.catbox.moe/8f7vex.msi https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.msi https://vdfccjpnedujhrzscjtq.supabase.co/storage/v1/object/public/image/v4.msi |
IP Address | 199.232.210.172 204.76.203.219 45.91.94.204 49.51.132.100 91.224.92.121 |
Hash | 054a32d6033b1744dca7f49b2e466ea2
112A86ECA3CB5A0B5E20AB744CC5AF93
2C32E44A013CBFC5A323EFB7694701D2
3A55D8F8F29716C694671834D8C6CB29
3D553B9061C03F891CE97D7D2E64DDEE
991EC6E04413F2D4D29341C17A8A54D5
A930F81E3FB0A226EC5904D9043A17B8
FD91321BF7FF7245DDA9B7B5D791ACE8
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "https://files.catbox.moe/8f7vex.msi" or url like "https://files.catbox.moe/8f7vex.msi" or siteurl like "https://files.catbox.moe/8f7vex.msi" or domainname like "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.msi" or url like "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.msi" or siteurl like "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.msi" or domainname like "https://auth.qgtxtebl.workers.dev/" or url like "https://auth.qgtxtebl.workers.dev/" or siteurl like "https://auth.qgtxtebl.workers.dev/" or domainname like "https://vdfccjpnedujhrzscjtq.supabase.co/storage/v1/object/public/image/v4.msi" or url like "https://vdfccjpnedujhrzscjtq.supabase.co/storage/v1/object/public/image/v4.msi" or siteurl like "https://vdfccjpnedujhrzscjtq.supabase.co/storage/v1/object/public/image/v4.msi" |
Detection Query 2 : | dstipaddress IN ("45.91.94.204","49.51.132.100","199.232.210.172","91.224.92.121","204.76.203.219") or srcipaddress IN ("45.91.94.204","49.51.132.100","199.232.210.172","91.224.92.121","204.76.203.219") |
Detection Query 3 : | md5hash IN ("FD91321BF7FF7245DDA9B7B5D791ACE8","3D553B9061C03F891CE97D7D2E64DDEE","2C32E44A013CBFC5A323EFB7694701D2","054a32d6033b1744dca7f49b2e466ea2","991EC6E04413F2D4D29341C17A8A54D5","3A55D8F8F29716C694671834D8C6CB29","112A86ECA3CB5A0B5E20AB744CC5AF93","A930F81E3FB0A226EC5904D9043A17B8")
|
Reference:
Storm-2603 Exploits SharePoint for fileless Intrusion and Ransomware Deployment