Threat actor
Storm-2603
Tracked by CyberSIXT since 27 Aug 2025 · last activity 5 Oct
CNMalpedia
- articles · all time
- 7+0 this week
- outlets
- 3
- CVEs exploited · attributed
- 2
- CVEs also mentioned · not attributed
- 7
7 articles from 3 outlets since 27 Aug 2025; the latest 21 days ago.
- Article
- Research report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Mon 5 Oct · 01:12 UTC | SecurityOnline | Longlegs Exploits SharePoint to Spread Warlock Ransomware at Scale |
| Thu 1 Oct · 13:38 UTC | Dark Reading | Warlock Ransomware Exploits SharePoint to Target Spanish-Speaking Regions |
| Mon 22 Jun · 16:51 UTC | Microsoft | One intrusion, two cyberattackers: Uncovering parallel threat activity |
| Fri 13 Feb · 01:15 UTC | SecurityOnline | Email Under Siege: Storm-2603 Exploits SmarterMail to Deploy Warlock Ransomware |
| Fri 24 Oct 2025 · 00:50 UTC | SecurityOnline | Warlock Ransomware Hits US Firms Exploiting SharePoint Zero-Day, Linked to China’s CamoFei APT |
| Fri 10 Oct 2025 · 02:35 UTC | SecurityOnline | DFIR Tool Hijacked: Ransomware Group Storm-2603 Abuses Velociraptor for Stealthy LockBit/Babuk Attacks |
| Wed 27 Aug 2025 · 22:58 UTC | Unit 42 | Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks |
Who reported 3 outlets, last 12 months
- SecurityOnline2
- Microsoft1
- Dark Reading1
CVEs exploited
2 CVEs an article attributes to Storm-2603CVE-2026-23760SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability · attributed by ReliaQuest, 13 FebCVSS9.3CriticalExploited96%EPSS10articles
CVE-2025-1055K7 Security Anti-Malware: IOCTL in K7RKScan.sys Allows Arbitrary Termination of High-Privilege and System Processes by a Low-Privilege User · attributed by Symantec, 5 OctCVSS5.6Medium–Not in KEV0.2%EPSS2articles
Also mentioned alongside Storm-2603 (not attributed)
7 CVEs named in the same articlesShow 7 CVEs
CVE-2026-50522Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityCVSS9.8CriticalExploited3.0%EPSS10articles
CVE-2026-58644Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityCVSS9.8CriticalExploited16%EPSS14articles
CVE-2026-24423SmarterTools SmarterMail Missing Authentication for Critical Function VulnerabilityCVSS9.3CriticalExploited88%EPSS8articles
CVE-2026-55040Microsoft SharePoint Weak Authentication VulnerabilityCVSS9.1CriticalExploited70%EPSS16articles
CVE-2026-45659Microsoft SharePoint Server Deserialization of Untrusted Data VulnerabilityCVSS8.8HighExploited2.7%EPSS12articles
CVE-2026-32201Microsoft SharePoint Server Improper Input Validation VulnerabilityCVSS6.5MediumExploited43%EPSS14articles
CVE-2026-56164Microsoft SharePoint Server Missing Authentication for Critical Function VulnerabilityCVSS5.3MediumExploited1.0%EPSS11articles
- Longlegs Exploits SharePoint to Spread Warlock Ransomware at ScaleSecurityOnline
- Warlock Ransomware Exploits SharePoint to Target Spanish-Speaking RegionsDark Reading
- One intrusion, two cyberattackers: Uncovering parallel threat activityMicrosoft
- Email Under Siege: Storm-2603 Exploits SmarterMail to Deploy Warlock RansomwareSecurityOnline
- Warlock Ransomware Hits US Firms Exploiting SharePoint Zero-Day, Linked to China’s CamoFei APTSecurityOnline
- DFIR Tool Hijacked: Ransomware Group Storm-2603 Abuses Velociraptor for Stealthy LockBit/Babuk AttacksSecurityOnline
- Project AK47: Uncovering a Link to the SharePoint Vulnerability AttacksUnit 42 · first in our coverage