In 2025, threat actors exploited vulnerabilities CVE-2025-53770 and CVE-2025-53771 in on-premises Microsoft SharePoint, allowing remote code execution through crafted HTTP requests.
One of the threat actors involved, identified as Storm-2603, deployed ransomware on the affected systems following successful exploitation. This activity was attributed to Storm-2603 by Microsoft, confirming their involvement in the ransomware deployment.
The attack followed a two-stage intrusion process, with an initial vulnerability fingerprinting on December 20, 2025, and the full remote code execution chain executed on December 24, 2025. This execution occurred through the IIS worker process, where the malicious payload was executed without being written to disk.
A notable characteristic of the attack was a three-day period of inactivity between the initial probe and the subsequent malicious activity. During this time, the webshell remained resident for the lifetime of the affected application domain, allowing for sustained access to the compromised systems.