A Chinese-linked threat group, identified as Storm-2603, exploited vulnerabilities in SharePoint ToolShell to inject a backdoor onto a network This article explores storm 2603 exploited. . Those who believed the July 2025 patching closed the story should be aware that unpatched servers were still being targeted months later.

One module silently installed MSI packages, while another created admin accounts through low-level Windows calls without using standard commands.

For SYSTEM privileges, the code utilized a named-pipe trick borrowed from the EfsPotato tool, which was effective because IIS worker processes possess the necessary impersonation privilege.

Potential IoCs include:

  • 45.91.94[.]204 SPN node
  • 49.51.132[.]100 SPN node
  • 199.232.210[.]172 C2 traffic relay
  • 91.224.92[.]121 Bulletproof-hosted C2 server
  • 204.76.203[.]219 Bulletproof-hosted C2 server
  • 0xFD91321BF7FF7245DDA9B7B5D791ACE8 vskp2 – webshell implant
  • 0x3A55D8F8F29716C694671834D8C6CB29 C:\ProgramFiles\Velociraptor\Velociraptor.exe
  • 0x991EC6E04413F2D4D29341C17A8A54D5 Abused legitimate VS Code
  • 0x3D553B9061C03F891CE97D7D2E64DDEE VS Code Insiders for tunneling
  • 0x2C32E44A013CBFC5A323EFB7694701D2 Abused tunneling tool executable
  • 0x112A86ECA3CB5A0B5E20AB744CC5AF93 7z.exe renamed for sideloading
  • 0xA930F81E3FB0A226EC5904D9043A17B8 C:\ProgramFiles(x86)\ZohoMeeting\UnAttended\ZohoMeeting.7z
  • 0x054a32d6033b1744dca7f49b2e466ea2 Vulnerable driver (rsndispot.sys)
  • Malicious DLL, Warlock ransomware AV killer (named in report text)
  • hxxps://vdfccjpnedujhrzscjtq[.]supabase[.]co/storage/v1/object/public/image/v4[.]msi Vulnerable Velociraptor package
  • hxxps://auth[.]qgtxtebl[.]workers[.]dev/ Velociraptor server URL
  • hxxps://github[.]com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64[.]msi Abused legitimate tunneling tool
  • hxxps://files[.]catbox[.]moe/8f7vex[.]msi Abused Zoho Assist Unattended Agent download URL
  • Trojan.MSIL.Agent.gen, Trojan.Win64.DLLhijack.cdp Kaspersky detection names
  • Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking.

Integrate Threat Intel from 16K SOCs.