The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603

Kaspersky SecurelistNovember 5, 2026Threat Intel

Kaspersky researchers analyze a complex fileless cyberattack by Storm-2603 involving ToolShell exploitation and subsequent runtime subversion, and discuss how to detect such intrusions.

Summary from Kaspersky Securelist.

Read the full article at Kaspersky Securelist

Explained

The technology and terms in this story. Learn more

ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.

The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603

Explained

More in Threat Intel

Scammers capitalize on GTA 6 hype to push malware and crypto cons

Chinese Nation-State Threat Activity Falls Sharply in Q2 and Q3 2026

SANS Stormcast Thursday, November 5th, 2026: Email Test Scripts; runZero oobscan BMC/IPMI; apt Signature Bypass (CVE-2026-109518); SonicWall GMS EOL Unpatched Flaws

Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes

Russian APT29 Targets Mobile Users with Watering Hole Attacks