Storm-2603 exploited SharePoint, then Warlock was blocked
First merged summary.
Kaspersky says Storm-2603 compromised an on-premises SharePoint server in December and its product stopped Warlock before encryption.
Kaspersky’s Securelist attributes, with moderate confidence, a customer’s on-premises SharePoint intrusion to China-linked Storm-2603. After a December 20 probe, attackers on December 24 exploited ToolShell flaws, including CVE-2025-53770 and CVE-2025-53771, and loaded a memory-only webshell inside w3wp.exe. They installed Velociraptor 0.73.4.0, affected by CVE-2025-6264, plus suo5 and other tunnels, including Cloudflare Tunnel, then tried to disable endpoint protection before launching Warlock. GBHackers says the December 24 source was 45.91.94.204; Cyber Security News calls it a Safing Privacy Network node. Kaspersky’s Proactive Defense Module blocked the ransomware before encryption; Securelist published the case on November 5, 2026.
- Webshell in w3wp.exe activated only for a specific User-Agent and used XOR.
- Velociraptor 0.73.4.0 was downloaded from Supabase and is vulnerable to CVE-2025-6264.
- Driver rsndispot.sys and a sideloaded Warlock AV killer targeted endpoint protection.
- GBHackers reports privilege escalation to SYSTEM through named-pipe impersonation.
- GBHackers also lists SharePoint flaws CVE-2025-49704 and CVE-2025-49706.
- Kaspersky’s Proactive Defense Module blocked Warlock before encryption.
Timeline
dated events in the reporting · oldest first- Nov 5, 2026Securelist published the December SharePoint intrusion case. · Cyber Security News
What each outlet adds
beyond the shared facts- GBHackersNames source IP, extra ToolShell CVEs, and SYSTEM escalation.
- Cyber Security NewsAdds December 20 probe, Safing node, blocked Warlock, and rsndispot.sys.
- Threat actors
- Storm-2603
- Malware
- Warlock
- Organizations
- KasperskySecurelistCisco Talos
- Countries
- China
Coverage
oldest first · one row per article · UTC- · 3d ago
GBHackersFirst report
Storm-2603 Exploits SharePoint ToolShell Flaws and Cloudflare Tunnels
Storm-2603 installed webshells and deployed Cloudflare Tunnels after exploiting SharePoint vulnerabilities.
- · 3d ago
Cyber Security News
Storm-2603 used SharePoint ToolShell flaws for a fileless backdoor
Kaspersky says the group hit an on-premises server on December 24 and its product blocked Warlock before encryption.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-49704+1 related CVE | Authenticated Code Injection RCE in Microsoft SharePoint | 8.8 group max | 100% | KEVRansomware | KEV |
| CVE-2025-53770 | Unauthenticated Deserialization RCE in Microsoft SharePoint Server on-premises | 9.8 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2025-53771 | Improper Authentication in Microsoft SharePoint Server Enables Network Spoofing | 6.5 | 100% | ||
| CVE-2025-6264 | Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints | 5.5 | 1% | PoC ×2 |