The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603
Kaspersky dissects Storm-2603's fileless SharePoint intrusion using ToolShell exploitation and runtime subversion—SOC teams should operationalise the detection guidance for in-memory threats in Microsoft 365 environments.
Summary written by editorial AI · Source link below
Kaspersky researchers analyze a complex fileless cyberattack by Storm-2603 involving ToolShell exploitation and subsequent runtime subversion, and discuss how to detect such intrusions.
Editorial Analysis
Framed for the CISO & Security Leaders desk
A fileless attack chain exploiting SharePoint demonstrates that advanced persistent threats can operate entirely in memory, evading traditional endpoint detection—relevant for any organisation using Microsoft 365.
Confirm with your SOC that SharePoint and M365 runtime telemetry is being collected and correlated, and that fileless attack detection rules are in place.
A sophisticated fileless attack breached SharePoint without touching disk—our Microsoft 365 detection capabilities need validation against this technique.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at Securelist (Kaspersky) in a new tab.
More from the Threat Intel Desk
- Hackers pull off $133 million French bank heist via service provider2d
- Fake security tools on GitHub push backdoors and infostealers3d
- The Good, the Bad and the Ugly in Cybersecurity - Week 45 (2026)3d
- CEO-spoofing scammers used AI to help steal more than $100 million, feds say3d
- Chainalysis says breach exposed credentials for all customers3d