> ## Content Index > Fetch the complete content index at: https://blog.alphahunt.io/llms.txt > Use this file to discover other available public pages before exploring further. # Storm-2603: Hybrid Espionage and Ransomware Operations Exploiting SharePoint ToolShell Vulnerabilities - URL: https://blog.alphahunt.io/storm-2603-hybrid-espionage-and-ransomware-operations-exploiting-sharepoint-toolshell-vulnerabilities/ - Published: 2025-08-07T12:00:53.000Z - Updated: 2026-10-23T23:47:29.000Z - Description: Storm-2603 is a China-based threat actor, first identified in 2025, leveraging a hybrid operational model that combines espionage tactics with financially motivated ransomware deployment. The group is distinct from, but shares some infrastructure and tooling with, other Chinese APTs such as... - Author: Wes - Tags: storm-2603, threat-actors, intrustion-set, 2025, china (Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :)) Stuck writing boring intelligence reports? *Or worse- trying to make ChatGPT do it the way you, a seasoned analyst would?* Does it take a chunks out of your day? Would you like help with the research? **write a report on Storm-2603 suitable for strategic decision makers, but don’t skimp on the technical deets** This **baseline** report was thoughtfully researched and took 10 minutes.. It's meant to be a rough draft for you to enhance with the unique insights that make you an invaluable analyst. We just did the initial grunt work.. Are you ready to level up your skillset? [Get Started Here!](http://alphahunt.io/?ref=blog.alphahunt.io) Did this help you? Forward it to a friend! --- ![](https://storage.ghost.io/c/06/e5/06e5730b-7d78-4713-9cec-6cba31d297f5/content/images/2025/08/Screenshot-2025-08-05-at-16.57.46.png) ![](https://storage.ghost.io/c/06/e5/06e5730b-7d78-4713-9cec-6cba31d297f5/content/images/2025/08/Screenshot-2025-08-05-at-16.58.00.png) --- # TL;DR ## Key Points 1. - Storm-2603, a China-based threat actor, is actively exploiting Microsoft SharePoint ToolShell vulnerabilities (CVE-2025-49704/49706/53770/53771) to deploy LockBit Black and Warlock ransomware, targeting government, critical infrastructure, and enterprise IT sectors globally. - Immediate patching, ASP.NET machine key rotation, and EDR deployment are critical to mitigate initial access and persistence. 2. - The group employs advanced TTPs, including BYOVD, DLL sideloading, custom AK47 C2 frameworks (HTTP/DNS), and open-source tools (PsExec, Impacket, masscan) for lateral movement, defense evasion, and ransomware propagation. - Monitoring for web shells, suspicious scheduled tasks, and C2 traffic to known Storm-2603 infrastructure is essential for early detection. 3. - Storm-2603 demonstrates a hybrid operational model, blending espionage and financially motivated ransomware, with evolving tradecraft and targeting scope. - Incident response plans, network segmentation, and tabletop exercises tailored to hybrid APT/ransomware scenarios are recommended for organizational resilience. --- ## Executive Summary Storm-2603 is a China-based threat actor, first identified in 2025, leveraging a hybrid operational model that combines espionage tactics with financially motivated ransomware deployment. The group is distinct from, but shares some infrastructure and tooling with, other Chinese APTs such as APT27 (Linen Typhoon) and APT31 (Violet Typhoon). Storm-2603 has been observed exploiting critical Microsoft SharePoint ToolShell vulnerabilities (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771) to gain initial access to on-premises servers in government, critical infrastructure, and enterprise IT environments across Latin America, Asia-Pacific, the United States, and Europe. Post-exploitation, Storm-2603 deploys web shells, steals credentials (using Mimikatz), and moves laterally via PsExec and Impacket. The group uses advanced defense evasion techniques, including Bring Your Own Vulnerable Driver (BYOVD) and DLL sideloading, to disable endpoint protections and deploy multiple ransomware families (LockBit Black, Warlock/X2anylock). Custom C2 frameworks (AK47HTTP, AK47DNS) and open-source tools (masscan, WinPcap, SharpHostInfo) support stealthy command and control, reconnaissance, and propagation. Storm-2603’s campaigns have impacted government agencies (including the US Nuclear Weapons Agency), financial services, manufacturing, and other sectors. The group’s hybrid motivation profile—espionage and financial gain—complicates attribution and response, with a plausible shift toward longer-term espionage using ransomware as cover. Strategic recommendations include urgent patching and key rotation on SharePoint servers, deployment and tuning of EDR solutions, integration of threat intelligence for IOC monitoring, and enhanced incident response planning with network segmentation. Organizations should monitor for specific TTPs (web shells, GPO modifications, C2 traffic) and prepare for both ransomware and APT-style intrusions. The threat landscape is expected to evolve, with Storm-2603 likely to refine its malware frameworks, expand targeting, and adapt TTPs in response to improved defenses. --- # Suggested Pivots 1. What specific indicators and **... (Upgrade to find out!) ...**, and how can these be detected in ongoing campaigns exploiting SharePoint vulnerabilities? 2. How effective are current mitigation strategies—including **... (Upgrade to find out!) ...**, and what documented case studies or incident reports highlight successes or failures? 3. What are the detailed technical evolutions of Storm-2603’s custom **... (Upgrade to find out!) ...** their persistence and evasion capabilities? How can detection and disruption methods be improved based on these insights? --- # Research & Attribution ## Historical Context Storm-2603 is a China-based threat actor first publicly identified in 2025 during investigations into the exploitation of Microsoft SharePoint Server vulnerabilities, collectively known as the ToolShell campaign. The group has been linked to ransomware operations deploying LockBit Black and Warlock (X2anylock) ransomware variants. While other Chinese APT groups such as Linen Typhoon (APT27) and Violet Typhoon (APT31) were also involved in ToolShell, Storm-2603 is tracked as a distinct actor with a hybrid operational model combining espionage and financially motivated ransomware deployment. ## Timeline - Early 2025: Storm-2603 linked to ransomware campaigns in Latin America and Asia-Pacific deploying LockBit Black and Warlock ransomware. - March 2025: Earliest observed campaigns using DNS tunneling and HTTP backdoors. - July 2025: Active exploitation of SharePoint vulnerabilities CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771 (ToolShell) to gain initial access. - July 18, 2025: Observed deployment of Warlock ransomware post-exploitation. - July 22, 2025: Microsoft publishes detailed analysis of Storm-2603's exploitation and ransomware deployment. ## Origin Storm-2603 is assessed with moderate confidence to be a China-based threat actor. It is tracked as a distinct entity separate from other Chinese APT groups such as Linen Typhoon and Violet Typhoon, although some infrastructure and tooling overlaps exist. The group exhibits a hybrid operational model combining espionage-like tactics with financially motivated ransomware deployment. ## Countries Targeted 1. Latin America (LATAM) - Targeted in ransomware campaigns deploying LockBit Black and Warlock ransomware. 2. Asia-Pacific (APAC) - Targeted in parallel with LATAM in ransomware campaigns. 3. United States - Targeted via exploitation of SharePoint vulnerabilities; includes critical infrastructure such as the US Nuclear Weapons Agency. 4. Europe - Indirectly targeted through espionage-related campaigns linked to related Chinese APT groups. 5. Other global regions - Likely targeted due to the broad exploitation of SharePoint vulnerabilities. ## Sectors Targeted 1. Government and Critical Infrastructure - Including US nuclear weapons agency and other sensitive government entities. 2. Enterprise IT - Particularly organizations running on-premises Microsoft SharePoint servers. 3. Financial Services - Targeted in espionage and ransomware campaigns. 4. Healthcare and Education - Indirectly targeted through related Chinese APT groups. 5. Manufacturing and Strategic Planning - Targeted by related Chinese APT groups and possibly Storm-2603. ## Motivation Storm-2603 exhibits a hybrid motivation profile combining espionage and financial gain through ransomware deployment. While the group deploys ransomware families LockBit Black and Warlock, its exact strategic objectives remain unclear, with possibilities including dual motivations of espionage and financial profit. ## Attack Types Storm-2603 primarily exploits known vulnerabilities in internet-facing on-premises Microsoft SharePoint servers (ToolShell vulnerabilities) to gain initial access. Post-exploitation activities include web shell deployment, credential theft, lateral movement, and ransomware deployment. The group uses a combination of custom malware, open-source tools, and advanced techniques such as DLL sideloading and Bring Your Own Vulnerable Driver (BYOVD) to disable defenses and deploy multiple ransomware families. ## Malware and Toolset Analysis - Custom backdoors: AK47 C2 framework with HTTP (AK47HTTP) and DNS (AK47DNS) clients. - Ransomware: LockBit Black and Warlock (X2anylock) deployed via DLL sideloading and MSI installers. - Open-source tools: masscan, WinPcap, SharpHostInfo, nxc, PsExec. - Antivirus terminator: Custom tool "VMToolsEng.exe" using BYOVD with signed driver "ServiceMouse.sys" from Antiy Labs to disable security software. ## C2 Infrastructure and Indicators - Domains: update.updatemicfosoft\[.\]com, msupdate.updatemicfosoft\[.\]com, microsfot\[.\]org. - IPs: 65.38.121.198, 131.226.2.6, 134.199.202.205, 104.238.159.149, 188.130.206.168. - File hashes: Multiple SHA-256 hashes for web shells (spinstall0.aspx variants), IIS backdoor (IIS\_Server\_dll.dll), and tools (SharpHostInfo.x64.exe, xd.exe). - URLs: c34718cbb4c6.ngrok-free\[.\]app/file.ps1 (PowerShell delivery). ## Impact and Tradecraft Evolution Storm-2603 has demonstrated a sophisticated hybrid approach blending espionage tactics with financially motivated ransomware deployment. The group has evolved to deploy multiple ransomware families simultaneously, use advanced defense evasion techniques like BYOVD, and leverage custom C2 frameworks. The exploitation of widely used enterprise software vulnerabilities (SharePoint) and the use of open-source tools for reconnaissance and lateral movement increase the threat's operational complexity and impact. --- [![CTA Image](https://storage.ghost.io/c/06/e5/06e5730b-7d78-4713-9cec-6cba31d297f5/content/images/2025/08/ah_slack.png)](https://alphahunt.io/?ref=blog.alphahunt.io) Ready to level up your intelligence game? [Sign Up! ](https://alphahunt.io/?ref=blog.alphahunt.io) --- # Recommendations, Actions, Suggested Pivots, Forecasts and Next Steps (Subscribers Only) --- # Recommendations, Actions and Next Steps 1. **Urgently Patch, Rotate Keys, and Harden On-Premises SharePoint Servers** - Apply all Microsoft security updates for SharePoint, specifically for CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771\. After patching, immediately rotate all ASP.NET machine keys and restart IIS, ensuring malicious modules are removed from configuration files. Disconnect any unsupported or end-of-life SharePoint servers from the internet. Conduct manual inspections for web shells, .dll payloads, and evidence of key exfiltration, as attackers have demonstrated the ability to persist even after patching. - This action directly addresses Storm-2603’s initial access and persistence mechanisms, closing the most critical attack vectors and preventing re-compromise through stolen cryptographic material. - Challenges include downtime, legacy system compatibility, and the need for careful coordination. For legacy or resource-constrained environments, prioritize internet-facing and business-critical systems, and consider phased patching with compensating controls (e.g., network isolation). - Metrics for success: 100% patch compliance, documented key rotation and IIS restarts, no unsupported SharePoint servers exposed, and verified removal of malicious modules. - MITRE ATT&CK: T1190 (Exploit Public-Facing Application), T1556.001 (Credential Rotation), T1505.003 (Web Shell). 2. **Deploy and Tune EDR, Monitor for Advanced TTPs, and Integrate Threat Intelligence** - Implement or enhance endpoint detection and response (EDR) and network monitoring to detect behaviors such as web shell deployment (spinstall0.aspx), DLL sideloading, BYOVD, credential theft, and suspicious PowerShell/cmd.exe activity. Integrate threat intelligence feeds for Storm-2603 IOCs (IPs, domains, file hashes) and leverage hunting queries and YARA/Nuclei rules from trusted sources (e.g., Recorded Future, Unit 42). Update WAF and IPS/IDS rules to block exploit patterns and anomalous behavior. - This recommendation increases detection and response speed, limits lateral movement, and enables rapid identification of post-exploitation activity, as demonstrated in real-world incidents (e.g., US Nuclear Agency disruption). - Considerations: Tuning for false positives, ensuring EDR coverage, and resource allocation for continuous monitoring. Organizations with limited resources should leverage managed detection services or threat intelligence platforms. - Metrics for success: Reduced mean time to detect/respond, increased detection of Storm-2603 TTPs, and timely alerting on IOC matches. - MITRE ATT&CK: T1562.001 (Defense Evasion), T1059 (Command and Scripting Interpreter), T1090 (Proxy), T1047 (Windows Management Instrumentation). 3. **Enhance Incident Response, Network Segmentation, and Tabletop Exercises for Ransomware/APT Scenarios** - Update and test incident response plans to address hybrid ransomware/APT threats. Segment networks to limit lateral movement from compromised SharePoint servers, enforce least privilege, and restrict administrative tool usage (e.g., PsExec, Impacket). Conduct tabletop exercises simulating Storm-2603’s attack chain, including credential theft, GPO modification, and ransomware deployment. Reference CISA’s #StopRansomware Guide and lessons from critical infrastructure incidents (e.g., Colonial Pipeline) to inform planning. - This ensures organizational readiness to contain and recover from Storm-2603-style attacks, minimizing operational and data loss. Network segmentation has proven effective in limiting ransomware spread in critical infrastructure case studies. - Challenges: Resource investment for training, business disruption during exercises, and complexity of segmentation in legacy environments. Mitigate by starting with high-value segments and using virtual segmentation where physical is impractical. - Metrics for success: Reduced time to containment in exercises, documented lessons learned, and measurable improvements in segmentation and privilege management. - MITRE ATT&CK: T1484.001 (Group Policy Modification), T1570 (Lateral Tool Transfer), T1486 (Data Encrypted for Impact). --- # Suggested Pivots 1. What specific indicators and TTPs would signal a shift in Storm-2603’s operational focus from ransomware deployment to long-term espionage activities, and how can these be detected in ongoing campaigns exploiting SharePoint vulnerabilities? 2. How effective are current mitigation strategies—including patching of ToolShell vulnerabilities, rotation of ASP.NET machine keys, deployment of AMSI and EDR solutions, and network segmentation—in preventing or limiting Storm-2603 intrusions, and what documented case studies or incident reports highlight successes or failures? 3. What are the detailed technical evolutions of Storm-2603’s custom malware frameworks (such as AK47 C2), including their DNS and HTTP backdoor components, and how do advanced techniques like BYOVD and DLL hijacking contribute to their persistence and evasion capabilities? How can detection and disruption methods be improved based on these insights? --- # Forecast ## Short-Term Forecast (3-6 months) Storm-2603 will continue exploiting ToolShell Microsoft SharePoint vulnerabilities (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771) to gain initial access, targeting unpatched on-premises SharePoint servers in government, critical infrastructure, and enterprise IT sectors across Latin America, Asia-Pacific, and the United States. The group’s hybrid model—combining espionage and financially motivated ransomware deployment (LockBit Black and Warlock)—will persist, leveraging advanced defense evasion techniques such as BYOVD and DLL sideloading to disable endpoint protections and maintain persistence. The use of custom AK47 C2 frameworks with HTTP and DNS backdoors will facilitate stealthy command and control. The rapid adoption of these exploits by multiple threat actors, including Storm-2603, will sustain a high operational tempo. Organizations that delay patching, key rotation, and endpoint detection deployment will remain vulnerable to compromise and ransomware impact. **Drivers and Constraints:** - Accelerating factors include the widespread availability of proof-of-concept exploits and slow patch adoption in resource-constrained or legacy environments. - Constraints include increased detection capabilities from EDR solutions and coordinated threat intelligence sharing, which may limit the group’s operational success and force TTP adaptations. ### Examples - Microsoft’s July 2025 analysis confirmed active exploitation and ransomware deployment by Storm-2603 against critical US government entities, including the US Nuclear Weapons Agency. - Check Point Research documented simultaneous deployment of multiple ransomware families and use of BYOVD to disable security tools, increasing attack effectiveness. - Unit 42 telemetry showed rapid shifts in payload delivery tactics (web shells vs. .NET modules) to evade detection during active exploitation phases. ### What to watch out for - Indicators of exploitation attempts on unpatched SharePoint servers, especially creation of web shells like spinstall0.aspx. - Network traffic to known Storm-2603 C2 domains (e.g., update.updatemicfosoft.com) and IPs (e.g., 65.38.121.198). - Detection of lateral movement tools such as PsExec and Impacket in enterprise networks. - Signs of ASP.NET machine key theft or reuse indicating persistence post-patching. - Increased ransomware activity involving LockBit Black and Warlock payloads delivered via DLL sideloading or MSI installers. --- ## Long-Term Forecast (12-24 months) Storm-2603 is likely to evolve its hybrid espionage and ransomware operations by expanding geographic targeting beyond Latin America and Asia-Pacific to include more European and global organizations, driven by the widespread use of Microsoft SharePoint and similar enterprise software. The group will refine its custom malware frameworks, particularly the AK47 C2, enhancing stealth and resilience through multi-protocol C2 channels (DNS and HTTP) and more sophisticated BYOVD techniques, potentially incorporating zero-day vulnerabilities in security products. The ransomware component may diversify with new or proprietary variants to evade detection and attribution. There is a plausible shift toward longer-term espionage campaigns using ransomware as a cover or secondary objective, especially against high-value government and strategic planning targets. This evolution will challenge existing detection and mitigation strategies, requiring continuous adaptation of security controls, threat intelligence integration, and incident response readiness. **Drivers and Constraints:** - Geopolitical tensions and international law enforcement actions may influence the group’s operational tempo and targeting choices, potentially constraining or redirecting activities. - Vendor patching improvements and widespread adoption of endpoint detection and response solutions may limit the effectiveness of current TTPs, forcing Storm-2603 to innovate or shift tactics. - The group’s hybrid motivation suggests adaptability to both espionage and financial incentives, increasing unpredictability but also providing patterns based on similar Chinese APT evolutions. ### Examples - Historical patterns from Chinese APT groups like APT27 (Linen Typhoon) and APT31 (Violet Typhoon) show expansion of targeting scope and refinement of malware toolsets over time. - The dual-use ransomware and espionage model parallels other hybrid threat actors such as FIN12 and Evilnum, who blend financial and intelligence objectives. - Use of DNS tunneling for C2, as seen in Storm-2603’s AK47DNS, is a known stealth technique employed by advanced threat actors like APT29 for long-term persistence. ### What to watch out for - Emergence of new ransomware variants or proprietary malware linked to Storm-2603 infrastructure. - Increased targeting of European and other global organizations beyond current LATAM and APAC focus. - Indicators of prolonged espionage activity without immediate ransomware deployment, such as data exfiltration or credential harvesting. - Discovery of zero-day exploits or novel BYOVD techniques used to bypass updated security controls. - Changes in TTPs indicating a shift from rapid ransomware deployment to stealthier, prolonged intrusions. ## MITRE ATT&CK IDs T1190, T1505.003, T1486, T1562.001, T1484.001, T1570, T1059, T1090, T1003.001, T1047, T1119, T1053.005, T1112, T1556.001 --- # Appendix ## References - (2025-07-22) - [Disrupting active exploitation of on-premises SharePoint vulnerabilities | Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/?ref=blog.alphahunt.io) - (2025-07-31) - [Before ToolShell: Exploring Storm-2603's Previous Ransomware Operations - Check Point Research](https://research.checkpoint.com/2025/before-toolshell-exploring-storm-2603s-previous-ransomware-operations/?ref=blog.alphahunt.io) - (2025-08-01) - [Storm-2603 Deploys DNS-Controlled Backdoor in Warlock and LockBit Ransomware Attacks | The Hacker News](https://thehackernews.com/2025/08/storm-2603-exploits-sharepoint-flaws-to.html?ref=blog.alphahunt.io) - (2025-07-24) - [Ransomware Actors Pile on 'ToolShell' SharePoint Bugs | Dark Reading](https://www.darkreading.com/endpoint-security/ransomware-actors-toolshell-sharepoint-bugs?ref=blog.alphahunt.io) - (2025-07-24) - [Storm-2603 activity linked to earlier ransomware campaigns | Field Effect](https://fieldeffect.com/blog/storm-2603-activity-linked-to-ransomware-campaigns?ref=blog.alphahunt.io) - (2025-07-31) - [UPDATE: Microsoft Releases Guidance on Exploitation of SharePoint Vulnerabilities | CISA](https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities?ref=blog.alphahunt.io) - (2025-07-23) - [ToolShell Exploit Chain Puts Thousands of SharePoint Servers at Risk | Recorded Future](https://www.recordedfuture.com/blog/toolshell-exploit-chain-thousands-sharepoint-servers-risk?ref=blog.alphahunt.io) - (2025-07-31) - [Active Exploitation of Microsoft SharePoint Vulnerabilities | Unit 42, Palo Alto Networks](https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/?ref=blog.alphahunt.io) - (2025-07-24) - [SharePoint Zero-Day Exploit (ToolShell) - Network Infrastructure Mapping | Resecurity](https://www.resecurity.com/blog/article/sharepoint-zero-day-exploit-cve-2025-53770-network-infrastructure-mapping?ref=blog.alphahunt.io) - (2025-07-24) - [What we know about the Microsoft SharePoint attacks | Cybersecurity Dive](https://www.cybersecuritydive.com/news/what-we-know-microsoft-sharepoint-attacks/753961/?ref=blog.alphahunt.io) - (2025-07-24) - [Storm-2603 spotted deploying ransomware on exploited SharePoint servers | Help Net Security](https://www.helpnetsecurity.com/2025/07/24/storm-2603-spotted-deploying-ransomware-on-exploited-sharepoint-servers/?ref=blog.alphahunt.io) - (2025-07-24) - [Microsoft says Warlock ransomware deployed in SharePoint attacks | The Record](https://therecord.media/microsoft-says-warlock-ransomware-deployed-in-sharepoint-attacks?ref=blog.alphahunt.io) - (2025-07-24) - [Storm-2603 Threat Intelligence for Damovo Customers](https://www.damovo.com/blog/storm-2603-threat-intelligence-for-damovo-customers/?ref=blog.alphahunt.io) - (2025-07-22) - [Critical SharePoint Zero-Day Exploited: What You Need to Know | SANS Internet Storm Center](https://www.sans.org/blog/critical-sharepoint-zero-day-exploited-what-you-need-to-know-about-cve-2025-53770?ref=blog.alphahunt.io) - (2025-07-25) - [Microsoft SharePoint ToolShell, Grafana Vulnerabilities | Black Kite](https://blackkite.com/blog/focus-friday-third-party-risks-in-sharepoint-toolshell-and-grafana-vulnerabilities/?ref=blog.alphahunt.io) - (2025-07-22) - [Cybersecurity Threat Advisory: Microsoft SharePoint zero-day vulnerability | Barracuda](https://blog.barracuda.com/2025/07/22/cybersecurity-threat-advisory-microsoft-sharepoin-zero-day-vulnerability?ref=blog.alphahunt.io) - (2025-07-22) - [July 2025 Microsoft SharePoint Server exploit | Syskit Point](https://www.syskit.com/blog/sharepoint-toolshell-zero-day-july-2025/?ref=blog.alphahunt.io) - (2025-07-21) - [CVE-2025-53770 “ToolShell” – Active SharePoint Zero Day | Ontinue](https://www.ontinue.com/resource/toolshell-active-sharepoint-zero-day/?ref=blog.alphahunt.io) - (2025-07-24) - [StopRansomware Guide | CISA](https://www.cisa.gov/stopransomware/ransomware-guide?ref=blog.alphahunt.io) - (2021-05) - [Cyber Case Study: Colonial Pipeline Ransomware Attack | INSURICA](https://insurica.com/blog/colonial-pipeline-ransomware-attack/?ref=blog.alphahunt.io) ## AlphaHunt (Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :)) Stuck writing boring intelligence reports? *Or worse- trying to make ChatGPT do it the way you, a seasoned analyst would?* Does it take a chunks out of your day? Would you like help with the research? **write a report on Storm-2603 suitable for strategic decision makers, but don’t skimp on the technical deets** This **baseline** report was thoughtfully researched and took 10 minutes.. It's meant to be a rough draft for you to enhance with the unique insights that make you an invaluable analyst. We just did the initial grunt work.. Are you ready to level up your skillset? [Get Started Here!](http://alphahunt.io/?ref=blog.alphahunt.io) Did this help you? Forward it to a friend! (c) 2025 CSIRT Gadgets, LLC --- ## MITRE ATT&CK ### Techniques 1. \[T1190\] Exploit Public-Facing Application – Storm-2603 exploited Microsoft SharePoint vulnerabilities (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771) for initial access, as documented in the ToolShell campaign. This allowed the group to gain a foothold in targeted organizations, including critical infrastructure and government entities. - [Disrupting active exploitation of on-premises SharePoint vulnerabilities | Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/?ref=blog.alphahunt.io) - [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/?ref=blog.alphahunt.io) 2. \[T1505.003\] Web Shell – The group deployed web shells (e.g., spinstall0.aspx) on compromised SharePoint servers for persistent access and command execution. These web shells were used to maintain access even after initial vulnerabilities were patched. - [Before ToolShell: Exploring Storm-2603's Previous Ransomware Operations - Check Point Research](https://research.checkpoint.com/2025/before-toolshell-exploring-storm-2603s-previous-ransomware-operations/?ref=blog.alphahunt.io) - [Web Shell](https://attack.mitre.org/techniques/T1505/003/?ref=blog.alphahunt.io) 3. \[T1486\] Data Encrypted for Impact – Storm-2603 deployed ransomware (LockBit Black, Warlock/X2anylock) to encrypt data for financial gain and operational disruption. The group used DLL sideloading and MSI installers to deploy ransomware payloads across networks. - [Active Exploitation of Microsoft SharePoint Vulnerabilities | Unit 42, Palo Alto Networks](https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/?ref=blog.alphahunt.io) - [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486/?ref=blog.alphahunt.io) ### Tactics 1. \[TA0001\] Initial Access – Achieved by exploiting public-facing SharePoint applications, enabling the group to begin their attack chain. - [Disrupting active exploitation of on-premises SharePoint vulnerabilities | Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/?ref=blog.alphahunt.io) - [Initial Access](https://attack.mitre.org/tactics/TA0001/?ref=blog.alphahunt.io) 2. \[TA0005\] Defense Evasion – Storm-2603 used BYOVD (Bring Your Own Vulnerable Driver), DLL sideloading, and disabling security tools to evade detection and maintain persistence. - [Before ToolShell: Exploring Storm-2603's Previous Ransomware Operations - Check Point Research](https://research.checkpoint.com/2025/before-toolshell-exploring-storm-2603s-previous-ransomware-operations/?ref=blog.alphahunt.io) - [Defense Evasion](https://attack.mitre.org/tactics/TA0005/?ref=blog.alphahunt.io) 3. \[TA0040\] Impact – The deployment of ransomware to disrupt operations and extort victims was a primary objective of Storm-2603’s campaigns. - [Active Exploitation of Microsoft SharePoint Vulnerabilities | Unit 42, Palo Alto Networks](https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/?ref=blog.alphahunt.io) - [Impact](https://attack.mitre.org/tactics/TA0040/?ref=blog.alphahunt.io) ### Procedures 1. \[T1562.001\] Disable or Modify Tools – Storm-2603 implemented BYOVD by deploying a custom tool (VMToolsEng.exe) that loaded the signed driver ServiceMouse.sys from Antiy Labs to disable endpoint security software. This was often chained with DLL sideloading to evade detection and ensure successful ransomware deployment. - [Disrupting active exploitation of on-premises SharePoint vulnerabilities | Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/?ref=blog.alphahunt.io) - [Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/?ref=blog.alphahunt.io) 2. \[T1484.001\] Group Policy Modification – The group modified Group Policy Objects (GPO) to distribute ransomware payloads (e.g., Warlock) across the network. This included changes to scheduled tasks and startup scripts, enabling rapid propagation and maximizing impact. - [Before ToolShell: Exploring Storm-2603's Previous Ransomware Operations - Check Point Research](https://research.checkpoint.com/2025/before-toolshell-exploring-storm-2603s-previous-ransomware-operations/?ref=blog.alphahunt.io) - [Domain Policy Modification: Group Policy Modification](https://attack.mitre.org/techniques/T1484/001/?ref=blog.alphahunt.io) 3. \[T1570\] Lateral Tool Transfer – Storm-2603 used Impacket and PsExec to move laterally within compromised environments, transferring tools and executing commands on remote systems. This facilitated the spread of ransomware and credential theft tools. - [Active Exploitation of Microsoft SharePoint Vulnerabilities | Unit 42, Palo Alto Networks](https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/?ref=blog.alphahunt.io) - [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570/?ref=blog.alphahunt.io) ### Software 1. \[S0039\] Mimikatz – Used by Storm-2603 for credential dumping from LSASS memory, enabling further lateral movement and privilege escalation. - [Disrupting active exploitation of on-premises SharePoint vulnerabilities | Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/?ref=blog.alphahunt.io) - [Mimikatz](https://attack.mitre.org/software/S0039/?ref=blog.alphahunt.io) 2. \[S0029\] PsExec – Utilized for remote command execution and lateral movement, often in conjunction with Impacket. - [Before ToolShell: Exploring Storm-2603's Previous Ransomware Operations - Check Point Research](https://research.checkpoint.com/2025/before-toolshell-exploring-storm-2603s-previous-ransomware-operations/?ref=blog.alphahunt.io) - [PsExec](https://attack.mitre.org/software/S0029/?ref=blog.alphahunt.io) 3. \[S0691\] Impacket – Used for lateral movement and tool transfer, supporting the spread of ransomware and credential theft utilities. - [Active Exploitation of Microsoft SharePoint Vulnerabilities | Unit 42, Palo Alto Networks](https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/?ref=blog.alphahunt.io) - [Impacket](https://attack.mitre.org/software/S0691/?ref=blog.alphahunt.io) ### Mitigations 1. \[M1050\] Exploit Protection – Apply all Microsoft security updates for SharePoint, rotate ASP.NET machine keys, and remove malicious modules to prevent exploitation and persistence. - [Disrupting active exploitation of on-premises SharePoint vulnerabilities | Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/?ref=blog.alphahunt.io) - [Exploit Protection](https://attack.mitre.org/mitigations/M1050/?ref=blog.alphahunt.io) 2. \[M1047\] Audit – Monitor for web shell deployment, suspicious scheduled tasks, and C2 communications to detect post-exploitation activity and lateral movement. - [Before ToolShell: Exploring Storm-2603's Previous Ransomware Operations - Check Point Research](https://research.checkpoint.com/2025/before-toolshell-exploring-storm-2603s-previous-ransomware-operations/?ref=blog.alphahunt.io) - [Audit](https://attack.mitre.org/mitigations/M1047/?ref=blog.alphahunt.io) 3. \[M1030\] Network Segmentation – Segment networks to limit lateral movement and restrict administrative tool usage, reducing the blast radius of successful intrusions. - [Active Exploitation of Microsoft SharePoint Vulnerabilities | Unit 42, Palo Alto Networks](https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/?ref=blog.alphahunt.io) - [Network Segmentation](https://attack.mitre.org/mitigations/M1030/?ref=blog.alphahunt.io)