Storm-2603 exploits SharePoint flaws and uses Cloudflare Tunnel to keep remote access
- Severity
- High
- Sources
- 1
What happened
Storm-2603, which Microsoft attributes to China and links to Warlock ransomware, exploited ToolShell vulnerabilities in on-premises SharePoint during a December intrusion. The actor deployed a memory-only webshell within the IIS worker process to avoid writing to disk, then established multiple tunnelling channels, including Cloudflare Tunnel, to persist after losing the initial foothold. Kaspersky rates its attribution as moderate confidence. The article gives no CVE identifiers or affected versions, so defenders should check for ToolShell exposure and hunt for unexpected tunnelling tools and IIS memory-resident webshells.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- No action needed.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Threat actors
Products