Kaspersky researchers have documented how a China-linked group used Microsoft SharePoint flaws to plant a backdoor that ran entirely in memory, then tried to launch ransomware before security software stopped it.

The report, published by Kaspersky's Securelist team on 5 November, covers an intrusion by the group tracked as Storm-2603. It began on 20 December, when a request probed the SharePoint ToolPane endpoint from infrastructure linked to ONYPHE. Three quiet days followed; the real attack came on Christmas Eve, when security teams run with fewer staff.

The attackers exploited the ToolShell chain — CVE-2025-53770 and CVE-2025-53771, bypasses of earlier fixes for CVE-2025-49704 and CVE-2025-49706. The crafted request came from 45.91.94.204, a Safing Privacy Network node that hides the true source behind relays, and loaded a webshell directly into the IIS worker process, w3wp.exe, writing nothing to disk.

No file on disk, several ways back in

The implant ran entirely in memory, talking to its operators over a custom binary protocol with XOR obfuscation, and built a TCP tunnel with the suo5 proxy tool to reach other machines on the network.

Through Velociraptor, a legitimate forensics tool installed in a vulnerable version (0.73.4.0, CVE-2025-6264), the group added backup routes — Zoho Assist, VS Code tunnelling, Cloudflare Tunnel and a reverse proxy — that did not need the webshell.

The group also dropped a vulnerable driver and a DLL identified as Warlock's antivirus killer. The final step failed: Kaspersky's Proactive Defense Module blocked the ransomware process before it could encrypt anything.

Kaspersky attributes the attack to Storm-2603 with moderate confidence, and Microsoft has linked the group to ransomware attacks using these flaws. Defenders should apply SharePoint updates, enable AMSI in full mode, rotate ASP.NET machine keys and restart IIS, preserving memory and IIS telemetry first, because a restart erases the implant.