THE SOC FILES 5: GHOST IN THE PIPELINE, OR A FILELESS SHAREPOINT BREACH BY STORM-2603

Summary from the TLDR InfoSec newsletter

Storm-2603 used the ONYPHE scanner to check a SharePoint server for ToolShell (CVE-2025-53770), waited three days, and on Christmas Eve loaded a webshell directly into IIS's w3wp.exe process memory. The webshell activated only for a specific User-Agent, tunneled into the internal network with suo5, escalated to SYSTEM using EfsPotato, and then moved to a vulnerable Velociraptor build, an EDR-killer driver, and a blocked Warlock ransomware attempt. Kaspersky attributed the intrusion with moderate confidence. Defenders should hunt for IIS paths that resolve in config but have no file on disk, which appear as IIS-Configuration ETW events 25 and 47 without the usual file-change monitoring events. Kaspersky has released CLRDeserializationExploitFinder to flag the deserialization exploit itself.