Kaspersky analyzed a Christmas Eve intrusion in which attackers exploited two Microsoft SharePoint flaws, kept access inside the Internet Information Services (IIS) worker process and attempted to deploy Warlock ransomware before Kaspersky Endpoint Security blocked the payload.
Kaspersky researchers investigated an intrusion involving CVE-2025-53770 and CVE-2025-53771, known as the ToolShell vulnerabilities in on-premises Microsoft SharePoint. The attackers used the absence of a patch installed after checking the system was vulnerable. Based on the technical analysis of the attacker’s tactics, techniques and procedures, Kaspersky experts attribute the case to Storm-2603 with moderate confidence.
The attacker used the IIS worker process, w3wp.exe, as an in-memory bridge into the victim environment. After gaining access, the attacker uploaded a vulnerable driver commonly used to disable EDR tools and then attempted to launch Warlock ransomware, which was detected and blocked by Kaspersky Endpoint Security solution.
The intrusion unfolded in two stages: the attacker first sent a single HTTP request to a SharePoint administrative endpoint associated with the ToolPane component to check whether the server was vulnerable. Several days later, on Christmas Eve, the actor returned to execute the full remote code execution chain on the same endpoint.
During the analysis of this incident, Kaspersky also observed webshell activity inside w3wp.exe, the Microsoft web process that handles SharePoint requests, indicating that the attacker had a malicious tool for remote control of the server. From that process, the actor could route traffic, elevate privileges, access credentials and move to other systems while operating within a trusted part of the application. This means defenders cannot rely solely on detecting malicious files stored on disk but also need to monitor for suspicious runtime activity, including unusual behavior by w3wp.exe, unexpected outbound connections, forced authentication attempts, misuse of legitimate security tokens and the sudden presence of remote administration or incident response tools after a server has been compromised.
“This case illustrates the operational risk posed by internet-facing business applications, particularly during holiday periods when response capacity may be reduced. For organizations the priority is to determine whether an exposed system was used to gain execution, move laterally or disrupt operations. An effective response requires visibility across memory, host and identity layers, along with the ability to contain threats before they affect business continuity,” says Rodrigo Wanderson, Kaspersky SOC expert.
Read the full report on Securelist.com to learn more about the technical details and indicators of compromise.
To stay safe, Kaspersky recommends that organizations preserve memory and IIS telemetry, contain affected hosts at the system level, hunt for persistence, rotate compromised credentials and exposed MachineKeys, and investigate attacker behavior beyond the initial exploit and known indicators of compromise. They are also advised to use multi-layered security solutions such as Kaspersky Next, which enables unified real-time protection, threat visibility, investigation and the response capabilities of EDR and XDR. Kaspersky Compromise Assessment, Managed Detection and Response and Incident Response help protect against evasive cyberattacks, investigate incidents and provide additional expertise if companies lack cybersecurity workers.
Cybersecurity specialists should have access to cyber threat intelligence, for example through Threat Intelligence services, so they can stay informed about the latest attacker techniques, tactics and procedures. Finally, organizations should regularly improve employees’ level of digital literacy, which can be achieved through specialized courses or training programs, such as the Kaspersky Automated Security Awareness Platform.
