Microsoft confirms China-linked Storm-2603 is exploiting SharePoint zero-days (CVE-2025-49706, -49704) to deploy Warlock ransomware on unpatched on-premises servers.

🚨 SharePoint just became SharePWN: Storm‑2603 blew through three fresh CVEs, torched > 400 orgs (yes, including the U.S. National Nuclear…

In a revelation, Unit 42 has exposed a financially motivated cyber threat actor cluster, dubbed CL-CRI-1040, with dangerous ties to known ransomware operations and links to the Storm-2603 actor pr…

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

A new report from Trend Micro details how the Warlock ransomware group is exploiting a vulnerability in unpatched Microsoft SharePoint servers to attack organizations.

Sophos uncovers GOLD SALEM, a new ransomware group exploiting SharePoint flaws. The group uses EDR evasion and legitimate tools to attack global targets.

In cybersecurity, the battlefield is rarely where you expect it. Sometimes, it’s not the flashy zero-days or exotic malware strains that…

Symantec exposed Warlock ransomware (a probable Anylock rebrand) used by China-linked Storm-2603. It exploits the SharePoint zero-day and BYOVD to disable security and encrypt files with the .x2anylock extension.

GOLD SALEM (Storm-2603) is exploiting SharePoint via ToolShell then abusing the Velociraptor DFIR tool as a ransomware precursor. The group deploys Warlock and LockBit 3.0 variants, often targeting critical infra.

SmarterTools has disclosed a comprehensive retrospective regarding a recent infiltration of its infrastructure, meticulously delineating the adversaries’ entry

Storm-2603 exploits SmarterMail vulnerability CVE-2026-23760 to deploy Warlock ransomware. Upgrade to Build 9511 immediately to prevent system compromise.

Trend Micro reveals Warlock ransomware is using kernel-level BYOVD attacks and abused IT tools to bypass security and hijack Active Directory.