The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603

Kaspersky researchers analyse a complex fileless intrusion by the threat actor Storm-2603, built on exploitation of the ToolShell SharePoint vulnerability chain followed by runtime subversion of the compromised server. The write-up walks through the attack’s stages and discusses how defenders can detect intrusions that leave few on-disk artefacts.