Storm-2603Threat actor
The group Microsoft tracks as Storm-2603 is assessed with medium confidence to be a China-based threat actor. Microsoft has not identified links between Storm-2603 and other known Chinese threat actors. Microsoft tracks this threat actor in association with attempts to steal MachineKeys via the on-premises SharePoint vulnerabilities.From MISP Galaxy
Last reported 20 days ago, by Security Affairs6 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1505.003Web Shell
“Upon successfully finding a way in, the threat actors have been found to drop web shells that can target multiple versions of SharePoint.”
- T1543.003Windows Service
“…ntec found that the ransomware was delivered through normal domain replication traffic, with three systems capturing dfsrs.exe, the Windows service responsible for that replication, delivering the malicious files.”
- T1136Create Account
“…re hosts by adding a fake-sounding admin account named SPSEPRDSetup, a decent bit of social camouflage since SharePoint really does create accounts with that kind of prefix.”
- T1219.002Remote Desktop Software
“In another attempt to facilitate access, they also installed open-source remote desktop software TightVNC, as seen via the binary path from EDR telemetry: "C:\Program Files\TightVNC\tvnserver.exe" -service.”
- T1546.016Installer Packages
“The attackers then pulled three separate installer packages from two different hosting services within ninety minutes, suggesting they had backups ready in case one path got blocked.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
Warlock Ransomware Still Exploits Year-Old SharePoint Flaws to Hit Critical Infrastructure“Symantec tracks the group behind Warlock as Longlegs, also known as Storm-2603, and ties it back to older China-nexus clusters called CL-CRI-1040, CamoFei, and ChamelGang.”
-
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware“Warlock, also tracked as Gold Salem, Longlegs, and Storm-2603, gained prominence in mid-2025 in connection with the zero-day exploitation of the "ToolShell" SharePoint flaws to deploy ransomware on targeted systems.”
-
Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks“Warlock is believed to be operated by a China-based hacking group tracked as Longlegs and Storm-2603, which has been linked to malicious operations such as CL-CRI-1040, CamoFei, and ChamelGang.”
-
Risky Bulletin: Authorities dismantle KillSec group, arrest members across Europe“"Warlock is developed by a China-nexus threat actor Symantec calls Longlegs (aka Storm-2603).”
-
Velociraptor Misuse, Pt. II: The Eye of the Storm“…ded a hostname that had been previously identified in August in a Singapore government security advisory, which pointed to activity by Storm-2603, a financially motivated threat cluster.”
-
Velociraptor WSUS Exploitation, Pt. I: WSUS-Up?“For example, the Cisco Talos team in October found Velociraptor activity that they attributed with medium confidence to Storm-2603.”
Indicators in its reports
named in the reports above- update.githubtestbak.workers[.]devin 2 reports
- hxxps://royal-boat-bf05.qgtxtebl.workers[.]dev/ssh.msiin 1 report
- royal-boat-bf05.qgtxtebl.workers[.]devin 1 report
- hxxps://royal-boat-bf05.qgtxtebl.workers[.]dev/v3.msiin 1 report
- 38.54.16[.]179in 1 report
- 91.236.230[.]76in 1 report
- chat.hcqhajfv.workers[.]devin 1 report
- hxxps://royal-boat-bf05.qgtxtebl.workers[.]dev/code.txtin 1 report
- c70fafe5f9a3e5a9…73aa88fd6682in 1 report
- 040d7ee5b7bb0b97…16fcacfeb423in 1 report
- hxxps://s3.wasabisys[.]com/kiessler/v4.msi,3348in 1 report
- mk[.]ggin 1 report
- scarnecchia[.]netin 1 report
Copy these 13 indicators · defanged
Thanks — we review every report.