Storm-2603
Threat actorSecurity timeline
- Activity reported by GBHackersStorm-2603 exploits SharePoint flaws and uses Cloudflare Tunnel to keep remote access
- Vulnerability reported by Kaspersky SecurelistStorm-2603 used ToolShell SharePoint flaws in a fileless intrusion over Christmas
Recent news
Storm-2603 exploits SharePoint flaws and uses Cloudflare Tunnel to keep remote access
Storm-2603, which Microsoft links to China and to Warlock ransomware, exploited the ToolShell flaws in on-premises SharePoint during a December intrusion. The attackers ran a memory-only webshell inside the IIS worker process and layered several tunnels, including Cloudflare Tunnel, to maintain access after the initial foothold was removed. Kaspersky assesses the attribution with moderate confidence.
Storm-2603 used ToolShell SharePoint flaws in a fileless intrusion over Christmas
Storm-2603 exploited CVE-2025-53770 and CVE-2025-53771 (ToolShell) in on-premises SharePoint to achieve remote code execution. The attacker ran a webshell inside the IIS worker process (w3wp.exe) that stayed memory-resident, after an initial probe on 20 December and a full exploitation on 24 December. The first probe was initially rated low priority and only linked to the intrusion retrospectively.