Storm-2603 Exploits SharePoint Vulnerabilities to Deploy Warlock Ransomware on Unpatched Systems
On July 24, 2025, Microsoft disclosed that the cyber group known as Storm-2603 is actively exploiting vulnerabilities in SharePoint software to deploy Warlock ransomware on targeted systems. This revelation is based on an extensive analysis and threat intelligence from ongoing monitoring of exploitation activities attributed to this financially motivated threat actor. Microsoft has identified Storm-2603 as a suspected threat group based in China, previously associated with deploying both Warlock and LockBit ransomware variants.
The malicious activities primarily exploit two critical vulnerabilities: CVE-2025-49706, a spoofing vulnerability, and CVE-2025-49704, which allows for remote code execution. These vulnerabilities specifically target unpatched on-premises SharePoint servers, enabling the threat actor to execute a web shell payload via the spinstall0.aspx script. According to Microsoft, this initial access paves the way for command execution through the w3wp.exe process, a service integral to SharePoint operations.
Following this initial breach, Storm-2603 executes a series of commands aimed at discovering more about the compromised environment. This method of reconnaissance aligns with several tactics outlined in the MITRE ATT&CK framework, notably initial access and discovery. The attack strategy underscores a common approach where threat actors first gain unauthorized access before systematically probing systems for valuable data or elevated privileges.
The implications of such attacks are particularly concerning for organizations that have not applied the latest security patches to their SharePoint servers. Vulnerabilities remain a stark entry point for cybercriminals looking to exploit outdated systems, especially in environments that handle sensitive information. Business owners must recognize the importance of maintaining up-to-date software and implementing robust cybersecurity practices.
As Storm-2603 continues to leverage these SharePoint vulnerabilities, the need for a proactive cybersecurity stance becomes critical. Organizations should consider structured vulnerability management programs and regular security assessments to mitigate potential risks. By understanding the tactics and techniques that adversaries employ, businesses can bolster their defenses and better protect their valuable data assets.
In the evolving landscape of cybersecurity threats, awareness and preparedness are essential for safeguarding against exploits like those utilized by Storm-2603. As the landscape shifts and new vulnerabilities emerge, maintaining vigilance and employing adaptive security measures will be paramount for organizations seeking to thwart ransomware and other cyber threats.
