Storm-2603 Archives • Daily CyberSecurity

Warlock Ransomware Group Hits Water and Telecom Operators Through SharePoint Flaws Warlock ransomware attack chain exploiting SharePoint vulnerabilities to hit critical infrastructure

Warlock ransomware attack chain exploiting SharePoint vulnerabilities to hit critical infrastructure

Warlock Ransomware Group Hits Water and Telecom Operators Through SharePoint Flaws

Do Son October 5, 2026

At a Glance Actor Longlegs (Symantec), also tracked as Storm-2603; described as China-nexus Activity SharePoint exploitation, security...

Cisco SD-WAN Vulnerability CVE-2026-20133 FortiGate Compromise Ivanti EPMM Zero-Day CVE-2026-1281 SmarterMail Vulnerability Storm-2603 WatchGuard Zero-Day, IKEv2 Out-of-Bounds Write Cisco Zero-Day, UAT-9686 Chinese APT FortiWeb RCE Exploitation CVE-2025-58034 VMware Zero-Day, Privilege Escalation Sitecore, remote code execution CVE-2025-53690 Windows CLFS, Privilege Escalation CVE-2024-47575 & CVE-2024-11120 CVE-2025-24983 vulnerability

Email Under Siege: Storm-2603 Exploits SmarterMail to Deploy Warlock Ransomware

Do Son February 13, 2026

A new report from ReliaQuest has uncovered a dangerous alliance between a China-based threat actor and a...

DFIR Tool Hijacked: Ransomware Group Storm-2603 Abuses Velociraptor for Stealthy LockBit/Babuk Attacks INC Ransom Pacific Cyber Threats OysterLoader Malware Rhysida Ransomware Black Basta Ransomware BYOVD Technique Velociraptor Abuse, Storm-2603 Ransomware Crypto24, Ransomware Ransomware Payments, UK Legislation ZACROS data breach

INC Ransom Pacific Cyber Threats OysterLoader Malware Rhysida Ransomware Black Basta Ransomware BYOVD Technique Velociraptor Abuse, Storm-2603 Ransomware Crypto24, Ransomware Ransomware Payments, UK Legislation ZACROS data breach

DFIR Tool Hijacked: Ransomware Group Storm-2603 Abuses Velociraptor for Stealthy LockBit/Babuk Attacks

Do Son October 10, 2025

Cisco Talos has confirmed that ransomware operators are now abusing Velociraptor, an open-source digital forensics and incident...

The AK47 Project: New Report Ties Storm-2603 to LockBit and Warlock Ransomware, SharePoint Exploits

Do Son August 7, 2025

In a revelation, Unit 42 has exposed a financially motivated cyber threat actor cluster, dubbed CL-CRI-1040, with...

Storm-2603: Chinese APT Deploys Warlock & LockBit with AK47C2 Framework Antivirus Terminator supported arguments when run without parameters

Storm-2603: Chinese APT Deploys Warlock & LockBit with AK47C2 Framework

Do Son August 4, 2025

Check Point Research (CPR) has detailed a previously undocumented Chinese-affiliated threat actor—Storm-2603—linked to aggressive campaigns exploiting Microsoft...

Microsoft: China-Backed APTs Actively Exploiting SharePoint Flaws (CVE-2025-49704 & CVE-2025-49706) Fortinet patch bypass 2026, FortiGate SSO authentication exploit SharePoint Zero-Day, China APTs Exploited Vulnerabilities 2023

Fortinet patch bypass 2026, FortiGate SSO authentication exploit SharePoint Zero-Day, China APTs Exploited Vulnerabilities 2023

Microsoft: China-Backed APTs Actively Exploiting SharePoint Flaws (CVE-2025-49704 & CVE-2025-49706)

Do Son July 23, 2025

Last week, the Microsoft Security Response Center (MSRC) issued an urgent advisory regarding active exploitation of critical...

Critical Alert 4 Active Exploits Detected Today

Warlock Ransomware Group Hits Water and Telecom Operators Through SharePoint Flaws

Email Under Siege: Storm-2603 Exploits SmarterMail to Deploy Warlock Ransomware

DFIR Tool Hijacked: Ransomware Group Storm-2603 Abuses Velociraptor for Stealthy LockBit/Babuk Attacks

The AK47 Project: New Report Ties Storm-2603 to LockBit and Warlock Ransomware, SharePoint Exploits

Storm-2603: Chinese APT Deploys Warlock & LockBit with AK47C2 Framework

Microsoft: China-Backed APTs Actively Exploiting SharePoint Flaws (CVE-2025-49704 & CVE-2025-49706)