Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks

Unit 42 has tied CL-CRI-1040, a financially motivated threat cluster, to the SharePoint vulnerability exploit chain through a toolset called Project AK47, which comprises a backdoor, ransomware and loaders. CL-CRI-1040 has been active since at least March 2025, with ties drawn to the Storm-2603 threat actor reported by Microsoft as exploiting SharePoint vulnerabilities to deploy ransomware.

According to Microsoft’s report, Storm-2603 is described as China-based, a characterization Unit 42 notes while assessing high-confidence links between Storm-2603 and CL-CRI-1040, including the AK47C2 backdoor, the AK47/X2ANYLOCK ransomware and DLL side-loading loaders. The SharePoint exploits target CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771, and the AK47 ransomware sample is also referenced as X2ANYLOCK.

The article further details components such as AK47C2’s dnsclient and httpclient, and mentions Warlock Client Leaked Data Show in connection with the broader activity, noting that attribution remains uncertain for some elements.