RansomwarecriticalExploited in the wild

Storm-2603 spotted deploying ransomware on exploited SharePoint servers

Help Net Securityby @zeljkazorzAug 4, 2025 · 12:44 UTC (Aug 4, 2025)4 min read3 · 1 read

Read at helpnetsecurity.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2025-53770 CVE-2025-49706 CVE-2025-49704 CVE-2025-53771 CVE-2020-1147

Tags: cve-2025-53770 cve-2025-49706 cve-2025-49704 cve-2025-53771 cve-2020-1147 ransomware

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2020-1147	XML Markup RCE in Microsoft .NET Framework, SharePoint, and Visual Studio	7.8	96%	KEVPoC ×4	Jul 14, 2020 KEV Nov 3, 2021
CVE-2025-49704 +1 related CVE CVE-2025-49706	Authenticated Code Injection RCE in Microsoft SharePoint	8.8 group max	100%	KEVRansomware	Jul 8, 2025 KEV Jul 22, 2025
CVE-2025-53770	Unauthenticated Deserialization RCE in Microsoft SharePoint Server on-premises	9.8	100%	KEVRansomwarePoC ×3	Jul 20, 2025 KEV Jul 20, 2025
CVE-2025-53771	Improper Authentication in Microsoft SharePoint Server Enables Network Spoofing	6.5	100%		Jul 20, 2025

From the original article

4 min read at helpnetsecurity.com

One of the groups that, in the past few weeks, has been exploiting vulnerabilities in on-prem SharePoint installation has been observed deploying Warlock ransomware, Microsoft shared on Wednesday.

Help Net Security

By @zeljkazorz · helpnetsecurity.com

Read the full article at Help Net Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.