Storm-2603 targets SharePoint flaws

More than 400 victims are affected by ransomware attacks exploiting SharePoint flaws.

Storm-2603 Uses SharePoint Vulnerabilities to Spread Warlock Ransomware

Microsoft has confirmed that the threat group known as Storm-2603 is behind the exploitation of vulnerabilities in SharePoint. These flaws allow the group to deploy Warlock ransomware on unpatched systems. The vulnerabilities being targeted include CVE-2025-49706 and CVE-2025-49704, which are related to spoofing and remote code execution. The attack begins with the use of a web shell payload, which grants attackers command execution capabilities.White House monitoring shows that this group, suspected to be based in China, has been previously known for using ransomware like LockBit. The attacks leverage various techniques, including credential harvesting using Mimikatz and lateral movement through the target’s network. Microsoft has urged users to improve their security measures, such as applying the latest updates and ensuring antivirus protections are in place. This advice comes amidst reports that over 400 organizations have already fallen victim to these attacks.

The ongoing exploitation of SharePoint vulnerabilities highlights a growing trend in cyberattacks where threat actors utilize well-known software flaws to carry out ransomware campaigns. The involvement of groups like Storm-2603 and their ties to state-sponsored actors raise concerns about the sophistication and resources that these entities possess. As the attacks continue, there is a pressing need for organizations to prioritize cybersecurity measures, especially for widely used platforms like SharePoint, to mitigate risks. The global ramifications of these activities cannot be understated, as they challenge both corporate interests and national security.

Highlights

The implications of these attacks underscore the need for vigilance against evolving cyber threats.