Storm-2603

Storm-2603 is a threat actor associated with exploitation of internet-facing on-premises Microsoft SharePoint servers and deployment of Warlock ransomware. The cluster is also tracked as GOLD SALEM by Sophos Counter Threat Unit and overlaps with CL-CRI-1040 in Unit 42 reporting; the actor has also referred to itself as Warlock Group. Microsoft has assessed the actor with moderate confidence as China-based, while other researchers have noted that this geographic attribution remains less certain. Activity attributed to Storm-2603 has been observed since at least March 2025 in Warlock ransomware operations and since mid-2025 in sustained exploitation of SharePoint vulnerabilities, especially the ToolShell chain. The actor has repeatedly used public-facing application exploitation for initial access, including SharePoint flaws and other enterprise software vulnerabilities, then established persistence through web shells, scheduled tasks, administrator account creation, and abuse of legitimate remote administration and DFIR tools. Reported post-compromise tooling includes Velociraptor, Cloudflare Tunnel, Zoho Assist, and Visual Studio Code SSH tunnels. Storm-2603 has been linked to exploitation of SharePoint vulnerabilities to deploy web shells, steal SharePoint cryptographic material, execute commands through IIS worker processes, dump credentials from LSASS with Mimikatz, move laterally with PsExec, Impacket, WMI, and WinRM, and distribute ransomware through Group Policy Objects. The actor has also used Bring Your Own Vulnerable Driver techniques to disable or tamper with endpoint protections, including use of vulnerable drivers such as NSecKrnl.sys and a vulnerable Baidu Antivirus driver in separate reporting. Additional observed tradecraft includes DLL sideloading, custom backdoors, reconnaissance of exposed systems, and data exfiltration. Victimology spans government, telecommunications, health care, finance, education, critical infrastructure, and commercial enterprises across North America, Europe, and South America. Warlock operations linked to Storm-2603 use extortion infrastructure including a leak site, and reporting indicates both ransomware deployment and theft-based extortion. The actor has publicly listed dozens of victims and has sought exploits, security-disabling tools, and cooperation from initial access brokers on underground forums. Storm-2603 is therefore best characterized as a ransomware and extortion actor with strong capability in exploiting enterprise edge and collaboration platforms for initial access, followed by credential theft, privilege escalation, lateral movement, persistence, defense evasion, exfiltration, and ransomware deployment.