Storm-2603 disabled security tools before deploying Warlock
Researchers say the group hit a water utility, a telecom, a regional government and a university after SharePoint access.
74
Threat actor
Storm-2603
- Mentions · 7d1
- Mentions · 30d2
- All mentions7
- First seenAug 12, 2026
- Last mentioned6d ago
Timeline
7 articles · newest firstWarlock Ransomware Still Exploits Year-Old SharePoint Flaws to Hit Critical Infrastructure
Warlock ransomware operators still exploit unpatched SharePoint flaws to hit water, telecom, government, and university targets.
78
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
Warlock is exploiting SharePoint flaws to disable defenses and deploy ransomware against critical infrastructure and government targets.
81
Warlock ransomware breach SharePoint in water, telecom operator attacks
Warlock ransomware exploited SharePoint ToolShell flaws to hit a water utility, telecom, government body, and university.
78
Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks
Warlock ransomware operators continue exploiting unpatched SharePoint servers at critical infrastructure, government, and education targets.
80
Warlock Ransomware Exploiting SharePoint Flaws to Attack Water and Telecom Operators
China-nexus Longlegs deploys Warlock ransomware via exploited SharePoint flaws against water utility, telecom, government, and university targets across three continents.
78
SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
CISA adds actively exploited SharePoint RCE CVE-2026-45659 (CVSS 8.8) to KEV; an August 11 update confirms ransomware groups are exploiting the flaw.
78
Related CVEs
by mentions- CVE-2025-1055<1%5.6A vulnerability in the K7RKScan.sys driver, part of the K7 Security Anti-Malware suite, allows a local low-privilege user to send crafted IOCTL requests to…
- CVE-2025-53770100%9.8Unauthenticated Deserialization RCE in Microsoft SharePoint Server on-premises
- CVE-2025-49704100%8.8Authenticated Code Injection RCE in Microsoft SharePoint
- CVE-2026-4565980%8.8Authenticated Deserialization RCE in Microsoft SharePoint Server (Actively Exploited)
- CVE-2025-4970699%6.5Improper Authentication in Microsoft SharePoint Server (ToolShell Campaign)
- CVE-2025-53771100%6.5Improper Authentication in Microsoft SharePoint Server Enables Network Spoofing
- CVE-2026-5864416%9.8Unauthenticated Deserialization RCE in Microsoft SharePoint Server
- CVE-2026-561641%9.8Missing Authentication in Microsoft SharePoint Server Allows Privilege Escalation
- CVE-2026-5504070%9.1Authentication Bypass in Microsoft SharePoint Server
- CVE-2026-3220143%6.5Improper Input Validation Spoofing Vulnerability in Microsoft SharePoint Server
Appears with
- Microsoftvendor · 6
- Warlockmalware · 5
- Symantecorganization · 5
- Visual Studio Codeproduct · 4
- Warlockthreat actor · 4
- Longlegsthreat actor · 4
- Microsoftorganization · 3
- SharePointproduct · 3
- CISAorganization · 3
- SharePoint Serverproduct · 2
- Velociraptorproduct · 2
- Carbon Blackorganization · 2
- K7RKScanproduct · 2
- Linen Typhoonthreat actor · 2
- ChamelGangthreat actor · 2
- Violet Typhoonthreat actor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.