Storm-2603 Threat Intelligence for Damovo Customers

Storm-2603, a state-sponsored or state-affiliated threat actor, began large-scale exploitation of on-premises SharePoint Server 2016, 2019, and Subscription Edition on 18 July 2025, using a serialised payload that abuses the ToolPane.aspx handler to plant a persistent web shell (spinstall0.aspx) and exfiltrate ASP.NET machine keys. A successful compromise enables full system takeover and rapid lateral movement, culminating in the deployment of Warlock ransomware within 60–90 minutes of initial access.

In Europe, attack volumes are highest in the Netherlands, Germany, France, Poland, and Sweden, with affected verticals spanning telecoms, government, higher education, and critical infrastructure.

Business leaders should:

• Schedule immediate installation of Microsoft July 2025 security updates (KB5002768, KB5002754, KB5002753).
• Confirm continuous telemetry coverage for SharePoint IIS (w3wp.exe), PowerShell, and network traffic hitting ToolPane.aspx endpoints.
• Empower SOCs with the detection rules, playbooks, and IOC feeds provided below, while resourcing incident responders to address potential compromises.

Background: The Storm-2603 ToolShell Campaign

Threat Actor Profile

Storm-2603 (a.k.a. Violet Typhoon) is linked to China-state interests and has a record of exploiting server-side deserialization flaws for credential theft and ransomware staging. The group routinely blends web-shell persistence with file-less PowerShell execution, DNS-over-HTTPS C2, and anti-forensic log manipulation.

Vulnerability Synopsis

Exploit Chain (ToolShell)

An exploit chain is a sequence of actions or techniques that an attacker uses to breach a system, with each step building upon the previous one to achieve deeper access or more damaging effects. In the context of the ToolShell exploit chain, steps 1-5 illustrate how an attacker methodically bypasses authentication controls, establishes persistence, leverages privilege escalation, and ultimately delivers a devastating ransomware payload:

1. Authenticated-bypass POST to /_layouts/15/ToolPane.aspx?DisplayMode=Edit with malicious Referrer: /_layouts/SignOut.aspx header triggers unsafe object deserialization.
2. Web-shell drop: spinstall0.aspx uploaded to C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\160.aspx.
3. Machine-key exfiltration via custom DLL (IISServerdll.dll) enabling cookie forgery and persistent session hijacking.
4. Privilege escalation with w3wp.exe spawning encoded PowerShell to deliver xd.exe reverse proxy and SharpHostInfo.x64.exe reconnaissance tool.
5. Ransomware stage: Warlock payload executed, renaming files with .warlock extension and dropping a !README!.txt note.

First, the attacker exploits a deserialization flaw via a crafted POST request, then deploys a web shell for sustained access. Following this, critical cryptographic material is exfiltrated to enable persistent session hijacking. The attacker then escalates privileges using encoded PowerShell commands to deploy additional tools for reconnaissance and reverse proxying. Finally, the attack culminates with the deployment of ransomware, encrypting files and demanding payment, solidifying the impact of the exploit chain.

Proof of Concept

Though no published Proof of Concept (PoC) code exists for the vulnerability at the time of this writing, the Viettel Cyber Security blog post entitled “SharePoint ToolShell – One Request PreAuth RCE Chain” provides a credible, technical breakdown of the ToolShell exploit chain and serves as a key source for detection, hunting, and incident response. It does not, however, distribute or directly link to a PoC exploit script.

The repository https://github.com/testanull/MS-SharePoint-July-Patch-RCE-PoC is a publicly available PoC exploit tool targeting SharePoint vulnerabilities CVE-2024-38094, CVE-2024-38024, and CVE-2024-38023. The tool, created in July 2024 and written entirely in Python, provides the PoC code and a linked PoC demonstration video for further guidance. At this time, there is no indication that this tool can be directly used to exploit the ToolShell vulnerabilities, although the methodology may offer some insight into SharePoint exploitation techniques in general.

Indicators of Compromise

We’ve compiled an extensive list of published IOCs into a downloadable JSON file for your analysis activities: sharepoint_vulnerabilities_iocs.json. The JSON file has its source field populated accordingly, so you can see the attribution for any data row by examining that field. Many of these indicators were contributed by Microsoft and CISA, with supplementary findings by leading commercial security research teams as well as detailed forensic reports and blog analyses. For hashes, filenames, domains, and IP addresses related to the July 2025 Storm-2603 information-stealer/backdoor campaign, all were attributed in the JSON to the Microsoft Security Blog published on 22 July 2025.

• Microsoft– Official Microsoft security advisories and technical threat intelligence.
• CISA – The United States Cybersecurity and Infrastructure Security Agency.
• SentinelOne – Security vendor providing threat research and reporting.
• Rapid7 – Security analytics and internet threat monitoring provider.
• Wiz – Cloud security research and analysis.
• SOCRadar – Threat intelligence and data analytics firm.
• Syskit – Microsoft 365 and SharePoint reporting tool vendor.
• Foresiet – Security intelligence provider.
• Logpoint – Security information and event management (SIEM) vendor.
• Technical Analysis – Based on publicly shared technical research from trusted analysts.
• Multiple sources – Used where several organisations or coordinated disclosures reported the same indicator.
• Microsoft Security Blog (2025-07-22) – For the most recent surge of IOCs, especially those from the post-exploitation investigations around CVE-2024-38094 and associated threats.

Detection & Monitoring Guidance

The following detection and monitoring guidance should help you prepare your infrastructure to detect the potential exploitation of the SharePoint vulnerabilities. Without appropriate logging or signalling enabled, your organisation will be blind to the attack attempts, making it extremely difficult to respond to an incident.

Log Sources to Enable

You can’t see the activity if you’re not logging it. The following guidance should be followed to enable the proper log source configurations for further analysis:

• IIS HTTP logs with full URL & header capture.
• Windows PowerShell Operational log (Event ID 4104).
  • Event ID 4104 logs the execution of PowerShell script blocks, which can be commands, functions, or entire scripts.
• Event Tracing for Windows (ETW) Antimalware Scan Interface (AMSI) events for script content.
• Firewall proxy logs to detect outbound update.updatemicfosoft.com traffic over port 443.

SIEM Correlation Rules

With the appropriate logging enabled, we highly recommend utilising a SIEM platform to collect, aggregate, and investigate detected activities. The following are just a few recommendations for some of the more commonly used SIEM platforms.

index=wineventlog (HttpRequestUri="/_layouts/15/ToolPane.aspx*" 
OR HttpRequestUri="*/spinstall*.aspx") 
OR (ProcessName="w3wp.exe" CommandLine="*EncodedCommand*")

let timeWindow = 24h;
let scriptExtensions = dynamic([".aspx", ".asmx", ".asax"]);
DeviceFileEvents
| where TimeGenerated > ago(timeWindow)
| where FolderPath has_any (
@"microsoft shared\Web Server Extensions\15\TEMPLATE\LAYOUTS",
@"microsoft shared\Web Server Extensions\16\TEMPLATE\LAYOUTS"
)
| where FileName has_any ("spinstall0", "spinstall", "spinstall1", "spinstall2")
or FileName has_any (scriptExtensions)
| where ActionType == "FileCreated"
| project TimeGenerated, DeviceName, InitiatingProcessFileName,
InitiatingProcessCommandLine, FileName, FolderPath, SHA256
| extend HostCustomEntity = DeviceName, FileHashCustomEntity = SHA256

spinstall*.aspx file I/O

event.dataset == "iis.access" and url.path == "/_layouts/15/ToolPane.aspx"

URI CONTAINS "ToolPane.aspx" AND REFERER CONTAINS "SignOut.aspx"

False-positive Note: Internal SharePoint admin activity may invoke ToolPane.aspx; correlation with anomalous referrer header and PowerShell spawn greatly reduces noise.

Damovo Partner Detection Solutions

The following Damovo partners offer products, platforms, or tools that, when properly deployed and configured, can help detect the active exploitation of the Microsoft SharePoint vulnerabilities.

Mitigation & Patching Guidance

Not every organisation can drop everything and patch servers for a multitude of reasons. The following mitigation guidance and patch guidance should help you put together a staged approach to protecting your organisation.

Mitigation Guidance

The following Damovo partners offer products, platforms, or tools that, when properly deployed and configured, can help block the active exploitation of the Microsoft SharePoint vulnerabilities while you schedule adequate time to patch your servers.

Patching Guidance

Apply July 2025 security updates KB5002768 (Subscription), KB5002754 (2019), and KB5002753 (2016) as soon as is feasible by your IT or infrastructure team. As with any patch, we strongly recommend testing the patch on a staging system to ensure compatibility with interconnected systems.

Rollback Plan: Snapshot VM before patch; uninstall via Control Panel → Installed Updates if regression occurs.

After applying the latest security updates above (or enabling AMSI), you must rotate SharePoint server ASP.NET machine keys and restart Internet Information Services (IIS) on all SharePoint servers. You can do this manually using PowerShell or using Central Admin: Trigger the Machine Key Rotation timer job:

• Navigate to the Central Administration site.
• Go to Monitoring -> Review job definition.
• Search for Machine Key Rotation Job and select Run Now.

Finally, you must restart IIS on all SharePoint servers using iisreset.exe.

Conclusion & Next Steps

Storm-2603’s weaponisation of the ToolShell vulnerabilities exemplifies the rapid pivot from zero-day disclosure to mass ransomware deployment. Patch urgency, precise detection logic, and rigorous incident response planning are, therefore, non-negotiable for EU entities subject to NIS2 or DORA compliance and operational resilience.

Executives should disseminate this bulletin to their SOC leaders today and mandate an immediate review of SharePoint exposure, telemetry coverage, and patch status. We also strongly suggest that you continue to monitor Microsoft’s “Disrupting active exploitation of on-premises SharePoint vulnerabilities” blog post for updates.

Even when security teams believe they have properly implemented patches and controls, we often find that critical systems remain vulnerable to attack.

Our security experts recommend a comprehensive approach that goes beyond just patching, through thorough validation through offensive security testing and defensive readiness assessments. This dual approach ensures that protective measures are not only installed correctly but also function effectively under real-world conditions.

By combining expert implementation with rigorous validation, organisations can achieve genuine protection rather than false confidence. Our team specialises in both deploying security measures and verifying their effectiveness, providing the assurance that comes from proven, tested defences.

If you have any questions or need assistance mitigating these or other vulnerabilities, please schedule an urgent consultation with Damovo’s security specialists.