Before ToolShell: Exploring Storm-2603’s Previous Ransomware Operations

Threat Score:
58
Check Point
2 days ago

Overview

Key Findings Introduction Check Point Research (CPR) has been closely monitoring the ongoing exploitation of a group of Microsoft SharePoint Server vulnerabilities collectively referred to as “ToolShell.” These active attacks leverage four vulnerabilities—CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771—and are attributed to multiple China affiliated threat actors. Among the threat groups identified by Microsoft, two are known […]...

Related Articles

5 articles
1

New Linux backdoor Plague bypasses auth via malicious PAM module

Security Affairs • 1 hour ago

A stealthy Linux backdoor named Plague, hidden as a malicious PAM module, allows attackers to bypass auth and maintain persistent SSH access. Nextron Systems researchers discovered a new stealthy Linux backdoor called Plague, hidden as a malicious PAM (Pluggable Authentication Module) module. It silently bypasses authentication and grants persistent SSH access. A Pluggable Authentication Module […]

Score
88
Read more
2

China Presses Nvidia Over Alleged Backdoors in H20 Chips Amid Tech Tensions

Security Affairs • 2 hours ago

China questioned Nvidia over suspected backdoors in its H20 chips, adding to rising tensions in the tech fight between the U.S. and Beijing. China’s internet watchdog has summoned Nvidia over concerns that its H20 AI chips may contain hidden backdoors. Nvidia H20 chips are AI GPUs tailored for the Chinese market, based on Hopper architecture. […]

Score
83
Read more
3

CL-STA-0969 Installs Covert Malware in Telecom Networks During 10-Month Espionage Campaign

The Hacker News • 8 hours ago

Telecommunications organizations in Southeast Asia have been targeted by a state- threat actor known asCL-STA-0969to facilitate remote control over compromised networks. Palo Alto Networks Unit 42 said it observed multiple incidents in the region, including one aimed at critical telecommunications infrastructure between February and November 2024. The attacks are characterized by the use of several tools to enable remote access, as well as the deployment of Cordscan, which can collect location d

Score
78
Read more
4

Julio de 2025: los ataques cibernéticos más grandes, ataques de ransomware e violaciones de datos

Ciberseguridadpyme • 14 hours ago

La ⁣ciberseguridad se ha convertido en una preocupación seria ya que nuestras ⁢vidas⁣ están significativamente entrelazadas con las tecnologías digitales. Julio de 2025 ha ‍demostrado ser un punto de inflexión debido a algunos de⁣ los mayores ataques⁤ cibernéticos, ataques de ransomware y violaciones de datos presenciadas en⁢ múltiples sectores ⁤y regiones⁣ a nivel mundial. los […] La entrada Julio de 2025: los ataques cibernéticos más grandes, ataques de ransomware e violaciones de datos se pub

Score
76
Read more
5

📥 Download the complete threat report to uncover the full scale of the FBI-flagged Funnull DNS infrastructure ->> https://lnkd.in/ehSBvCBx The FBI's recent FLASH alert exposed #Funnull as the backbone of a global cryptocurrency #fraud operation active since - LinkedIn

News • 6 hours ago

EnglishUnited States Deutsch English Español Français Italiano العربية All languages Afrikaans azərbaycan bosanski català Čeština Cymraeg Dansk Deutsch eesti EnglishUnited Kingdom EspañolEspaña EspañolLatinoamérica euskara Filipino FrançaisCanada FrançaisFrance Gaeilge galego Hrvatski Indonesia isiZulu íslenska Italiano Kiswahili latviešu lietuvių magyar Melayu Nederlands norsk o‘zbek polski PortuguêsBrasil PortuguêsPortugal română shqip Slovenčina slovenščina srpski (latinica) Suomi Svenska Tiế

Score
75
Read more