Storm-2603 exploited ToolShell (CVE-2025-53770/53771) in on-premises SharePoint to deploy a fully fileless webshell inside w3wp.exe, later pivoting to Warlock ransomware after weeks of stealthy access. Key findings: - The intrusion followed a deliberate timing strategy. A fingerprinting probe on Dec 20 (consistent with ONYPHE's active vulnerability checker) was followed by three days of silence, then full RCE execution on Christmas Eve (Dec 24) when security staffing is typically reduced. The gap caused the initial probe to be triaged as low priority and delayed correlation until retrospective analysis. Attribution to Storm-2603 rests on the ToolShell exploitation pattern, Warlock-linked EDR killer (C:\programdata\rsndispot.sys, MD5 054a32d6033b1744dca7f49b2e466ea2), and Velociraptor abuse previously documented by Cisco Talos in October 2025. - The webshell (vskp2, MD5 0xFD91321BF7FF7245DDA9B7B5D791ACE8) never touched disk. It was injected directly into the http://ASP.NET runtime inside w3wp.exe, persisting for the lifetime of the application domain. The main orchestrator G.cs registered a custom VirtualPathProvider via reflection to hook http://ASP.NET's virtual-path processing, used GetCacheKey() as the interception point, and filtered traffic by a specific User-Agent header so the implant stayed dormant against unrecognized requests. C2 used a custom binary protocol with XOR obfuscation over HTTP, blending into normal SharePoint traffic. The suo5 tool implemented full-duplex TCP tunneling to pivot inside the target network, all proxied through the SharePoint host. - Post-exploitation moved aggressively once the in-memory bridge was established. w3wp.exe spawned msiexec.exe to silently install a Velociraptor MSI (version 0.73.4.0, vulnerable to CVE-2025-6264) fetched from hxxps://vdfccjpnedujhrzscjtq.supabase[.]co/storage/v1/object/public/image/v4[.]msi. Storm-2603 then deployed layered persistence: Zoho Assist Unattended (fetched from hxxps://files.catbox[.]moe/8f7vex[.]msi), VS Code CLI tunneling (MD5 0x3D553B9061C03F891CE97D7D2E64DDEE), Cloudflare Tunnel (hxxps://github[.]com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64[.]msi), and a lightweight reverse proxy. Privilege escalation used EfsPotato's named-pipe impersonation via EFSRPC to coerce LSASS.exe and obtain a SYSTEM token without dropping a standalone binary. - For detection, the Kaspersky report points to two reliable runtime signals. For deserialization exploitation: watch CLR loader events for Microsoft.GeneratedCode appearing in the same application domain as App_Web_toolpane.aspx immediately after a request to the ToolPane endpoint. Scan process memory and helper assemblies for strings including ObjectDataProvider, ExpandedWrapper, and LosFormatter. For the VPP-based memory shell: use the Microsoft-Windows-IIS-Configuration ETW provider. Events 25 and 47 record path-to-physical mappings; events 17, 18, 19, and 21 track the FileChangeNotificationMonitor chain for disk-backed files. A virtual path showing positive events 25/47 with no corresponding events 17/18/19/21 and no matching file on disk is the primary indicator of a memory-resident implant. Hunt priority: query ETW for w3wp.exe making outbound TCP connections to non-Microsoft infrastructure, spawning msiexec.exe, or touching samlib.dll via P/Invoke. Correlate any ToolPane endpoint requests with subsequent CLR loader events in the same application domain. The report includes full IOC tables and references CLRDeserializationExploitFinder and VirtualPathProvider Lab for detection tooling. Memory and IIS ETW telemetry must be preserved before any IIS restart, since recycling the application pool destroys the implant's runtime state permanently. #DFIR_Radar