Skip to content

CyberSIXT Search

Threat actor · coverage timeline

Storm-2603

7 articles from 4 outlets between 27 Aug 2025 and 5 Oct. First reported by Unit 42.

Articles: 7; all time · from 4 outlets
Days with coverage: 7; across 405 days
Busiest day: 1; no day with more than one
Last 7 days: 0a day; vs 0 a day before
First report: 27 Aug 2025; Unit 42
CVEs named: 3; 2 in CISA KEV · in these articles

Coverage over time

7 articles · 27 Aug 2025 – 5 Oct

27 Aug 2025First report27 Aug 2025 · Unit 42

Show as table

Storm-2603: articles per day
Day (UTC)	Articles	Outlets
Wed 27 Aug 2025	1	Unit 42 1
Fri 10 Oct 2025	1	SecurityOnline 1
Fri 24 Oct 2025	1	SecurityOnline 1
Fri 13 Feb	1	SecurityOnline 1
Mon 22 Jun	1	Microsoft 1
Thu 1 Oct	1	Dark Reading 1
Mon 5 Oct	1	SecurityOnline 1

Articles

7 articles

Mon 5 Oct1 article

01:12
Longlegs Exploits SharePoint to Spread Warlock Ransomware at ScaleSecurityOnline

Thu 1 Oct1 article

13:38
Warlock Ransomware Exploits SharePoint to Target Spanish-Speaking RegionsDark Reading

Mon 22 Jun1 article

16:51
One intrusion, two cyberattackers: Uncovering parallel threat activityMicrosoft

Fri 13 Feb1 article

01:15
Email Under Siege: Storm-2603 Exploits SmarterMail to Deploy Warlock RansomwareSecurityOnline

Fri 24 Oct 2025 20251 article

00:50
Warlock Ransomware Hits US Firms Exploiting SharePoint Zero-Day, Linked to China’s CamoFei APTSecurityOnline

Fri 10 Oct 2025 20251 article

02:35
DFIR Tool Hijacked: Ransomware Group Storm-2603 Abuses Velociraptor for Stealthy LockBit/Babuk AttacksSecurityOnline

Wed 27 Aug 2025 20251 article

22:58
Project AK47: Uncovering a Link to the SharePoint Vulnerability AttacksUnit 42 · first report