SharePoint: CVE-2025-53770 Exploited by Storm-2603

At-A-Glance Incident Diagnostic Telemetry

---

Executive Incident Briefing (2-Minute CISO Brief)

1. Strategic Incident Overview

In December, a threat actor exploited CVE-2025-53770 in an on-premises Microsoft SharePoint to achieve remote code execution. The actor used the IIS worker process as an in-memory bridge to maintain access and control, keeping the access and control layer entirely within w3wp.exe without writing anything to disk. The attack chain involved a vulnerability fingerprinting request on December 20, followed by a second inbound connection from Pfcloud UG infrastructure on December 20, and the main malicious activity occurred on December 24, resulting in a webshell execution within the IIS worker process. The implant remained resident for the lifetime of the affected application domain.

The threat actor used a multi-module in-memory framework, where execution is orchestrated through the main component (G.cs) and extended via multiple functional units across namespaces. The main webshell component is G.cs, which orchestrates the implant's execution context, lifecycle, C2 and session management. The implant uses a custom binary protocol with XOR-based obfuscation to exchange data with the C2, blending into normal application traffic.

The attack was attributed to Storm-2603, a threat actor known for ransomware-related ToolShell activity, distinguishing it from other actors whose observed activity was primarily focused on credential theft, espionage, and data exfiltration.

2. Business Impact & Perimeter Exposure

The attack resulted in a data breach, with the threat actor gaining remote code execution on the target's systems. The implant remained resident for the lifetime of the affected application domain, allowing the threat actor to maintain access and control. The attack had a significant impact on the target's business, with potential downtime and operational disruption.

3. Compliance & Governance Blast Radius

The attack may trigger regulatory compliance requirements, including CISA KEV/BOD and GDPR Art. 33, due to the potential for data exfiltration and unauthorized access to sensitive information.

---

Breach Architecture & Blast Radius Analysis

Compromise Vector & Exposure Mechanics

The attack chain involved a vulnerability fingerprinting request on December 20, which originated from infrastructure associated with ONYPHE, an internet-scale attack surface discovery and management platform. The request characteristics were consistent with ONYPHE's vulnerability checks, which use active, non-intrusive probes to identify internet-exposed systems vulnerable to specific CVEs. For ToolShell, ONYPHE adopted the approach used by Niels Hofmans (hazcod), which attempts to inject a harmless marker into the target server to find out if it is vulnerable.

The main malicious activity occurred on December 24, resulting in a webshell execution within the IIS worker process (w3wp.exe). The payload was not written to disk; rather, it was loaded directly into the ASP.NET runtime and used during subsequent request processing. The implant remained resident for the lifetime of the affected application domain. This runtime state was lost when the application pool was recycled or IIS was restarted.

The webshell the attackers injected into the w3wp.exe runtime is a multi-module in-memory framework, where execution is orchestrated through the main component (G.cs) and extended via multiple functional units across namespaces. The main webshell component is G.cs, which orchestrates the implant's execution context, lifecycle, C2 and session management. The implant uses a custom binary protocol with XOR-based obfuscation to exchange data with the C2, blending into normal application traffic.

Adversaries frequently leverage compromised credentials, infostealer session tokens, or misconfigured cloud access policies to bypass perimeter defenses. Once inside cloud tenancies, threat actors execute automated enumeration to exfiltrate database records and object storage repositories.

Impacted Asset Telemetry & Exfiltration Scope

Forensic analysis indicates targeting of customer identity tables, corporate emails, and API configurations, exposing affected organizations to downstream credential-stuffing and targeted spear-phishing campaigns.

---

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

---

Threat Actor Attribution & Extortion Tactics

The attack was attributed to Storm-2603, a threat actor known for ransomware-related ToolShell activity. Storm-2603 is a threat actor that has been observed engaging in ransomware-related ToolShell activity, distinguishing it from other actors whose observed activity was primarily focused on credential theft, espionage, and data exfiltration.

---

Incident Response & Containment Playbook

1. Credential Invalidation & Session Termination

• Force tenant-wide credential resets and invalidate all active session tokens and OAuth refresh secrets.
• Revoke all long-lived API keys, IAM access tokens, and administrative credentials across cloud environments.

2. Cloud IAM & Storage Bucket Hardening

• Enforce strict least-privilege role-based access control (RBAC) and disable public access on all cloud storage buckets.
• Require conditional access policies requiring managed, compliant devices for administrative console access.

3. Compromise Verification & Identity Hunting

Microsoft Sentinel Hunting Query (KQL): Anomalous Bulk Download

CloudAppEvents
| where ActionType in~ ("FileDownloaded", "DataExported", "StorageBlobRead")
| summarize DownloadCount = count() by AccountName, IPAddress, bin(TimeGenerated, 1h)
| where DownloadCount > 100
| order by DownloadCount desc

4. Verification & Audit Checklist

-1.1

---

Exposure Telemetry & Breach Indicators

Review tenant audit logs to identify anomalous data egress originating from unmanaged IP addresses.

---

Frequently Asked Questions (FAQ)

1. Was sensitive customer or corporate data exfiltrated during the SharePoint breach?

Forensic investigations confirm unauthorized access to corporate cloud repositories and database records, creating immediate risks of credential-stuffing and targeted spear-phishing campaigns.

2. What initial compromise vectors were leveraged by the threat actors?

Threat actors commonly exploit compromised identity tokens, unrotated service account credentials, or misconfigured cloud storage access policies to achieve unauthorized cloud tenant ingress.

3. What immediate containment steps should security teams execute?

Immediately invalidate all active session tokens, rotate tenant-wide administrative credentials, enforce least-privilege IAM policies, and restrict cloud storage buckets to internal VPC endpoints.

4. What regulatory disclosure requirements apply to this incident?

Public enterprises must evaluate materiality under SEC Item 1.05 of Form 8-K (4 business days), while GDPR Article 33 mandates supervisory authority notification within 72 hours if personal data is affected.