Storm-2603 exploits SharePoint flaws and uses Cloudflare Tunnel to keep remote access
THREAT ACTORStorm-2603redteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Storm-2603, which Microsoft links to China and to Warlock ransomware, exploited the ToolShell flaws in on-premises SharePoint during a December intrusion. The attackers ran a memory-only webshell inside the IIS worker process and layered several tunnels, including Cloudflare Tunnel, to maintain access after the initial foothold was removed. Kaspersky assesses the attribution with moderate confidence.
For IT people · Written by AI from 1 source · Wrong?
What to do
- No action needed.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
GBHackers
Who and what is in it
Threat actors
Products