Ransomwarehigh
Storm-2603 Deploys DNS-Controlled Backdoor in Warlock and LockBit Ransomware Attacks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-49704+1 related CVE | Authenticated Code Injection RCE in Microsoft SharePoint | 8.8 group max | 100% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | updatemicfosoft.com | at uses DNS for command-and-control with the domain "update.updatemicfosoft[.]com." The backdoor is part of the AK47 C2 framework, alongsid |
From the original article
3 min read at thehackernews.com
The threat actor linked to the exploitation of the recently disclosed security flaws in Microsoft SharePoint Server is using a bespoke command-and-control (C2) framework called AK47 C2 (also spelled ak47c2) in its operations.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.