Threat Actor 🇨🇳 China

Storm-2603

The group Microsoft tracks as Storm-2603 is assessed with medium confidence to be a China-based threat actor. Microsoft has not identified links between Storm-2603 and other known Chinese threat actors. Microsoft tracks this threat actor in association with attempts to steal MachineKeys via the on-premises SharePoint vulnerabilities. Although Microsoft has observed this threat actor deploying Warlock and Lockbit ransomware in the past, Microsoft is currently unable to confidently assess the threat actor’s objectives. Additional actors may use these exploits to target unpatched on-premises SharePoint systems, further emphasizing the need for organizations to implement mitigations and security updates immediately.

Indicators of Compromise 22

Domain catbox[.]moe Domain m365[.]credential[.]harvesting[.]page Domain wasabisys[.]com Filename rclone.exe SHA-256 071e662fc5bc0e54bcfd49493467062570d0307dc46f0fb51a68239d281427c6 SHA-256 1f94ea00be79b1e4e8e0b7bbf2212f2373da1e13f92b4ca2e9e0ffc5f93e452b SHA-256 28a859046a43fc8a7a7453075130dd649eb2d1dd0ebf0abae5d575438a25ece9 SHA-256 568561d224ef29e5051233ab12d568242e95d911b08ce7f2c9bf2604255611a9 SHA-256 5b165b01f9a1395cae79e0f85b7a1c10dc089340cf4e7be48813ac2f8686ed61 SHA-256 6240e39475f04bfe55ab7cba8746bd08901d7678b1c7742334d56f2bc8620a35 SHA-256 6aecf805f72c9f35dadda98177f11ca6a36e8e7e4348d72eaf1a80a899aa6566 SHA-256 6c48a510642a1ba516dbc5effe3671524566b146e04d99ab7f4832f66b3f95aa SHA-256 7803ae7ba5d4e7d38e73745b3f321c2ca714f3141699d984322fa92e0ff037a1 SHA-256 7acf21677322ef2aa835b5836d3e4b8a6b78ae10aa29d6640885e933f83a4b01 SHA-256 7be8e37bc61005599e4e6817eb2a3a4a5519fded76cb8bf11d7296787c754d40 SHA-256 929e3fdd3068057632b52ecdfd575ab389390c852b2f4e65dc32f20c87521600 SHA-256 db15923c814a4b00ddb79f9c72f8546a44302ac2c66c7cc89a144cb2c2bb40fa SHA-256 dbdc1beeb5c72d7b505a9a6c31263fc900ea3330a59f08e574fd172f3596c1b8 SHA-256 e4ea34a7c2b51982a6c42c6367119f34bec9aeb9a60937836540035583a5b3bc SHA-256 e6c216cec379f418179a3f6a79df54dcf6e6e269a3ce3479fd7e6d4a15ac066e Package MeshAgent Package Zoho Assist Unattended Agent

MITRE ATT&CK TTPs 38

Credential Access

Remote System Discovery

Remote Desktop Protocol

Lateral Movement

Lateral Movement

Exfiltration Over Alternative Protocol

Scheduled Task/Job

Dynamic-link Library Injection

Defense Evasion

Indicator Removal

Defense Evasion

Command And Control

Defense Evasion

System Information Discovery

File and Directory Discovery

Account Discovery

Command And Control

Ingress Tool Transfer

Command And Control

Password Spraying

Credential Access

Multi-Factor Authentication Interception

Credential Access

External Remote Services

Exploit Public-Facing Application

Exploitation of Remote Services

Lateral Movement

Compiled HTML File

Defense Evasion

Remote Access Software

Command And Control

Domain or Tenant Policy Modification

Defense Evasion

Data Destruction

Data Encrypted for Impact

Cloud Service Discovery

Internal Spearphishing

Lateral Movement

Steal or Forge Kerberos Tickets

Credential Access

Email Hiding Rules

Defense Evasion

Exfiltration Over Web Service

Protocol Tunneling

Command And Control

Multi-Factor Authentication Request Generation

Credential Access

Source Articles

Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware

The China-linked threat actor Warlock, also known as Longlegs or Gold Salem, is actively exploiting vulnerabilities in on-premises Microsoft SharePoint Server deployments to gain initial access, deploy web shells, and achieve remote code execution. The group targets organizations in Portuguese- and Spanish-speaking countries, including critical infrastructure, government, and education sectors. After gaining access, Warlock uses DLL sideloading, legitimate cloud storage services for payload delivery, and the BYOVD technique with a vulnerable driver to disable security tools. The attackers then deploy ransomware at scale by staging payloads in the SYSVOL share and leveraging living-off-the-land techniques such as VS Code tunnels for persistence and lateral movement.

hacker-news ·3w ago

IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains

In Q2 2026, phishing remained the dominant initial access vector, accounting for over half of incident response engagements, with attackers increasingly leveraging QR code-embedded PDFs and trusted cloud platforms to bypass defenses. Threat actors, including the newly observed Sinobi ransomware group and Warlock (Storm-2603), weaponized legitimate remote management tools such as trojanized MeshAgent and Zoho Assist for stealthy persistence and lateral movement. Authentication abuse surged, with adversaries bypassing MFA using adversary-in-the-middle proxies, session token theft, and MFA fatigue attacks. The PhaaS platform ARToken was identified, offering a comprehensive toolkit for Microsoft 365 compromise via OAuth-based phishing, highlighting a growing trend in commoditized, sophisticated access-as-a-service operations.

talos ·3mo ago

ToolShell Used to Compromise Telecoms Company in Middle East | SECURITY.COM

China-based threat actors exploited the ToolShell vulnerability (CVE-2025-53770) to compromise a telecoms company in the Middle East and multiple government agencies globally shortly after the patch was released in July 2025. The attackers deployed backdoors such as Zingdoor and ShadowPad, used DLL sideloading techniques, and leveraged tools like KrustyLoader and Sliver for post-exploitation. Activities indicate espionage motives, with credential theft and lateral movement observed across compromised networks.