Cyber Tempest: SharePoint Vulnerabilities Fueled by Storm-2603’s Ransomware Blitz

Summary

• Storm-2603, a China-based threat actor, is exploiting on-premises SharePoint flaws in the ToolShell exploit chain.
• Microsoft said that starting July 18, 2025, it saw the group deploying Warlock ransomware through these flaws.
• Once inside, the attackers steal credentials with Mimikatz and push ransomware through modified Group Policy Objects.
• Microsoft urges customers to apply the on-premises SharePoint security updates immediately.

Storm-2603 Turns ToolShell Into Ransomware

A China-based hacking group that Microsoft tracks as Storm-2603 is deploying Warlock ransomware on Microsoft SharePoint servers left open to the ToolShell attacks. The exploit chain uses CVE-2025-49706 and CVE-2025-49704, which Dutch security firm Eye Security first saw being exploited as zero-days in July 2025. “Starting on July 18, 2025, Microsoft has observed Storm-2603 deploying ransomware using these vulnerabilities,” the company said.

What Microsoft Found

Microsoft has seen Storm-2603 deploy Warlock and LockBit ransomware in the past, but said it is “currently unable to confidently assess the threat actor’s objectives.” The company also linked two Chinese state-backed groups, Linen Typhoon and Violet Typhoon, to the SharePoint attacks. Only on-premises SharePoint servers are affected. SharePoint Online in Microsoft 365 is not.

Inside the Attack Chain

After getting in through SharePoint, Storm-2603 operators use Mimikatz to pull plaintext credentials from LSASS memory. They move laterally with PsExec and the Impacket toolkit, run commands through Windows Management Instrumentation (WMI) and modify Group Policy Objects to push Warlock ransomware across the network.

How Widespread the Attacks Are

The damage is broad. Eye Security said attackers had infected at least 400 servers and breached 148 organizations worldwide. Shadowserver was tracking more than 420 SharePoint servers still exposed online and vulnerable.

Victims Reported So Far

The U.S. Department of Energy confirmed that the National Nuclear Security Administration was breached, though it had found no evidence that classified information was compromised. Bloomberg reported breaches at the Department of Education, the Rhode Island General Assembly and Florida’s Department of Revenue.

What Defenders Should Do

Microsoft’s message is blunt: “Customers should apply the on-premises SharePoint Server security updates immediately and follow the detailed mitigation guidance in our blog.” CISA has also added CVE-2025-53770, a related remote code execution flaw in the same chain, to its catalog of exploited vulnerabilities.

Beyond Patching

Patching alone may not be enough, since many servers were compromised before fixes were applied. Teams should hunt for web shells and signs of credential theft, rotate SharePoint machine keys, and watch for unusual Group Policy changes.

The Takeaway

The ToolShell attacks show how quickly a zero-day can move from espionage to ransomware. Organizations running on-premises SharePoint should assume exposure, patch at once and check for signs of intrusion.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.