Storm-2603
Storm-2603 is a threat actor tracked by Microsoft with moderate confidence as China-based. Known aliases in the provided content include CL-CRI-1040, GOLD SALEM, and Warlock Group. The actor is associated with Warlock ransomware deployment, and Microsoft reporting also states it had previously deployed LockBit ransomware; Talos additionally observed Babuk ransomware files in a Storm-2603-linked incident. The group has actively targeted vulnerable internet-facing and on-premises Microsoft SharePoint servers since at least mid-2025, especially during exploitation of the ToolShell vulnerability chain involving CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771. Multiple sources in the content state Storm-2603 exploited these flaws to deploy web shells, obtain initial access, steal SharePoint ASP.NET MachineKeys, and conduct ransomware or extortion activity. Unit 42 tracked related activity as CL-CRI-1040 and assessed moderate-confidence overlap with Storm-2603. Check Point also linked ToolShell exploitation to Storm-2603 alongside APT27 and APT31. Observed tradecraft in the provided content includes deployment of the spinstall0.aspx web shell and related variants; reconnaissance requests for files such as win.ini and web.config; execution via w3wp.exe; creation of local and domain administrator accounts for persistence; scheduled tasks and IIS component manipulation; credential dumping with Mimikatz against LSASS; lateral movement with PsExec, Impacket, WMI, and WinRM; and modification of Group Policy Objects to distribute Warlock ransomware. Microsoft and other reporting also describe Storm-2603 disabling security services through registry modifications and using Bring Your Own Vulnerable Driver techniques, including NSecKrnl.sys to gain kernel-level access and disable endpoint protections, and a vulnerable Baidu Antivirus driver associated with CVE-2024-51324 to terminate EDR. The actor has also abused legitimate tools for persistence, command and control, and remote access, including Velociraptor, Cloudflare Tunnels, Zoho Assist, and Visual Studio Code SSH or network tunnels. Sophos reporting describes a Golang-based WebSockets backdoor used after SharePoint exploitation. Talos attributed one ransomware engagement to Storm-2603 with moderate confidence based on overlapping TTPs. Beyond SharePoint, the provided content links Storm-2603/Warlock activity to exploitation of SmarterMail CVE-2026-23760, SolarWinds Web Help Desk CVE-2025-40551, and Gladinet CentreStack CVE-2025-14611. Victimology in the content spans government, telecommunications, energy and natural resources, agriculture, and commercial organizations, with reported victims across North America, Europe, South America, Latin America, and APAC.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
41 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
21 malware families attributed to this actor across reporting.
16 additional families tracked in Mallory.
Associated vulnerabilities
10 CVEs this actor has used in observed campaigns. 10 of them exploited in the wild.
CVE-2025–53770 is a remote code execution vulnerability in Microsoft SharePoint with a CVSS score of 9.8. At the time of discovery, sustained exploitation attempts were observed against on premise SharePoint installations worldwide. This vulnerability is known to have been exploited by China based nation state threat actor groups APT27 and APT31, and by another China based ransomware gang Storm 2603, targeting internet connected SharePoint servers to deploy web shells and obtain initial access.
The group exploited publicly disclosed vulnerabilities, including CVE-2025-49706 and CVE-2025-49704, to gain an initial foothold.
The group exploited publicly disclosed vulnerabilities, including CVE-2025-49706 and CVE-2025-49704, to gain an initial foothold.
Starting in mid-July 2025, threat actors began actively exploiting two path traversal vulnerabilities affecting on-premises SharePoint servers: CVE-2025-53770 and CVE-2025-53771. These two vulnerabilities are related to CVE-2025-49704 and CVE-2025-49706... attackers managed to eliminate the need to be authenticated to obtain a valid signature, resulting in unauthenticated remote code execution.
SmarterMail CVE-2026-23760 Storm-2603 (Warlock) ... observed during intrusions that lead to WarLock ransomware deployment or data exfiltration
5 more CVEs tied to this actor tracked in Mallory.
Observables
103 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting multi-stage intrusions against unpatched on-premises SharePoint servers, exploiting known vulnerabilities for initial access, establishing persistence, performing reconnaissance, creating remote access channels, escalating privileges, and enabling ransomware/backdoor operations.
Compromised on-premises SharePoint environments, exploited known vulnerabilities, conducted reconnaissance for sensitive files and possible local file inclusion weaknesses, and maintained long-term persistence using legitimate remote administration and tunneling tools.
Used SharePoint flaws to conduct extortion campaigns.
China-linked threat group mentioned as one of several actors exploiting the SmarterMail zero-day CVE-2026-23760.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.