The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603

Executive summary In 2025, several threat actors exploited CVE-2025-53770 and CVE-2025-53771 (ToolShell vulnerabilities) in on-premises Microsoft SharePoint to achieve remote code execution through crafted HTTP requests. One of the threat actors deployed ransomware on the target’s systems after successful exploitation.

Read the full article at Kaspersky Securelist →