Storm-2603 Expands SharePoint Exploitation in Attacks on Critical Infrastructure

Summary

Symantec says Storm-2603 continues exploiting SharePoint flaws in attacks on critical infrastructure and other organizations, deploying webshells, tools to disable security software, and Warlock ransomware.

Key points

• Symantec reports at least four recent Warlock attacks against organizations in Portuguese- and Spanish-speaking countries, including a water utility, telecom provider, government body, and university.
• Storm-2603 exploits SharePoint flaws, including ToolShell; Symantec says its arsenal may also include CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, CVE-2026-50522, and CVE-2026-55040.
• One intrusion involved disabling security software on at least 40 systems and running Warlock ransomware on at least 33.
• The reported intrusion sequence can include webshell deployment, ASP.NET machine key exfiltration, and a forced signed payload for remote code execution.
• Storm-2603 uses DLL sideloading, a vulnerable driver to disable security tools, and living-off-the-land tools; it has also abused Visual Studio Code tunnels for covert access.
• The group stages Warlock payloads in SYSVOL, allowing them to replicate across domain controllers for ransomware deployment at scale.

MITRE ATT&CK

CVE

Threat Actors

Malware

Vendors

Products

Industries

Related Articles

• Warlock Ransomware Group Exploits SharePoint Flaws and Disables Security ToolsLinen Typhoon · Longlegs · Storm-2603
• Warlock Exploits SharePoint Flaws to Disable Defenses and Deploy RansomwareLonglegs · Storm-2603 · Warlock
• Warlock Ransomware Targets Spanish- and Portuguese-Speaking OrganizationsLonglegs · Storm-2603 · Warlock
• Warlock Ransomware Group Hits Water and Telecom Operators, Continues Exploiting SharePointLonglegs · Storm-2603 · Warlock
• Warlock Ransomware Expands Its Attack Chain With Tunnels and Vulnerable-Driver AbuseWarlock · Microsoft SharePoint · T1190