# The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603

Storm-2603 exploited SharePoint ToolShell deserialization (CVE-2025-53770/53771) to run a fileless w3wp.exe webshell, escalating to SYSTEM and attempting Warlock ransomware.

- Payout: Real-world hack
- Severity: critical
- Program: Microsoft
- Analysis by: Alexander Rodchenko, Rodrigo Wanderson
- Disclosed: 2026-11-05
- CVE: CVE-2025-53770, CVE-2025-53771
- Write-up quality: 8/10
- Original: https://securelist.com/storm-2603-fileless-toolshell-attack/121467/
- Library page: https://bugbountylibrary.com/r/blog%3Asecurelist-com-storm-2603-fileless-toolshell-attack-121467
- Tags: area:web domain:web impact:data-leak impact:privesc impact:rce kind:incident platform:threat-intel sev:critical tech:dotnet tech:windows technique:source-review vuln:deserialization vuln:privilege-escalation vuln:rce

**Target:** On-premises SharePoint ToolPane endpoint (ASP.NET/IIS w3wp.exe)
**Root cause:** Unsafe .NET deserialization (LosFormatter/BinaryFormatter) in the ToolPane endpoint lets attacker-controlled streams reconstruct dangerous object graphs (ObjectDataProvider, ExpandedWrapper), yielding code execution inside the IIS worker process.
**Steps:**
1. Fingerprint target with a single HTTP request to the SharePoint ToolPane administrative endpoint to test CVE-2025-53770 (ONYPHE-style harmless marker injection).
2. Wait ~3 days, then send a crafted HTTP request to the same ToolPane endpoint from an SPN exit node (45.91.94.204) to trigger deserialization RCE.
3. Payload loads in-memory into w3wp.exe; G.cs registers a custom VirtualPathProvider via RegisterVirtualPassProviderInternal and hooks GetCacheKey(), activating only on a specific User-Agent.
4. Use suo5-style full-duplex TCP tunnel over HTTP for C2 and pivoting into the internal network.
5. Escalate to SYSTEM via EfsPotato: EfsrTiny calls EfsRpcEncryptFileSrv with `\\localhost` path, LSASS connects to attacker named pipe, ImpersonateNamedPipeClient + CreateProcessAsUser.
6. Create admin accounts via samlib.dll P/Invoke (SAMRPCNative) instead of net.exe.
7. Spawn msiexec.exe to install Velociraptor MSI from Supabase, then deploy Zoho Assist, VS Code CLI, Cloudflare Tunnel for redundant access.
8. Load vulnerable rsndispot.sys driver and sideload Warlock AV-killer DLL; attempt Warlock ransomware (blocked by Kaspersky).
**How found:** Retrospective SOC analysis correlated a Dec 20 ONYPHE-style vulnerability fingerprint request with Dec 24 exploitation on the same ToolPane endpoint; loader events showing Microsoft.GeneratedCode and App_Web_toolpane.aspx assemblies alongside ObjectDataProvider/ExpandedWrapper strings revealed deserialization; ETW IIS-Configuration events 25/47 without file-change events 17-21 exposed the VirtualPathProvider implant.
**Exploitation:** Attacker used an SPN exit node to send a crafted deserialization request to the ToolPane endpoint, executing a memory-resident C# webshell in w3wp.exe. The implant proxied C2 via suo5 tunnels, escalated to SYSTEM through EFSRPC named-pipe coercion, created SAM admin accounts, installed Velociraptor for command execution, and staged multiple tunnels plus an EDR killer before attempting ransomware deployment.
**Escalation:** IIS worker (SeImpersonatePrivilege) -> EfsPotato LSASS token impersonation -> SYSTEM -> SAM admin account creation -> Velociraptor execution framework -> redundant tunnels -> EDR kill -> ransomware.
**Insight:** Hunt for VirtualPathProvider implants by pairing IIS-Configuration ETW events 25/47 (config-to-physical path mapping) with the absence of FileChangeNotificationMonitor events 17-21 for the same path: a path IIS resolves but the filesystem doesn't back is a memory shell. Also flag Microsoft.GeneratedCode loading in the same window as a ToolPane request.

## Write-ups of the same bug (oldest first)
- 2025-07-21: [SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-sharepoint-vulnerabilities-cve-2025-53770-cve-2025-53771-everything-you-need-to-k) — Wiz Research
- 2026-11-05: [The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603](https://bugbountylibrary.com/r/blog%3Asecurelist-com-storm-2603-fileless-toolshell-attack-121467) — Alexander Rodchenko, Rodrigo Wanderson (this one)