Storm-2603 ToolShell Intrusion: The Fileless Chain Inside w3wp.exe, Step by Step

## Executive summary: Kaspersky's Securelist analysis describes a 2025 on-premises SharePoint intrusion where ToolShell authentication and deserialization flaws were exploited to install an in-memory web shell in w3wp.exe, escalate to SYSTEM via LSASS token impersonation, deploy Velociraptor and multiple tunnels, and attempt Warlock ransomware; the report maps CVEs, ATT&CK techniques, IOCs, and recommends memory capture, patching, ASP.NET machine-key rotation, and hunting for runtime indicators.