blog.talosintelligence.com Storm-2603 Exploits ToolShell Vulnerabilities in Ransomware Campaign
Article Content
- •Storm-2603 exploited ToolShell vulnerabilities in SharePoint for ransomware deployment.
- •Initial probing occurred on December 20, 2025, with exploitation on December 24.
- •Cisco Talos confirmed the use of Velociraptor in conjunction with Babuk ransomware.
In 2025, threat actor Storm-2603 exploited vulnerabilities CVE-2025-53770 and CVE-2025-53771 in Microsoft SharePoint to achieve remote code execution via crafted HTTP requests. This led to ransomware deployment on affected systems. The attack utilized the IIS worker process (w3wp.exe) to maintain access without writing artifacts to disk. A retrospective analysis identified the attack timeline, which included initial vulnerability probing on December 20, followed by exploitation on December 24. Cisco Talos later linked this activity to the use of Velociraptor in ransomware attacks, further associating it with Storm-2603. Evidence of Babuk ransomware files was found on victim networks, indicating a broader impact. The incident highlights the ongoing threat posed by this actor and the nature of the exploited vulnerabilities.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (4)
Following this threat?
Track Babuk, Storm-2603 and CVE-2025-53770 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What vulnerabilities were exploited?
What tools were used in the attack?
How can we protect against this threat?
Continue Reading
Warlock Ransomware Group Targets Global Infrastructure via SharePoint Exploits The China-linked Warlock ransomware group, tracked as Storm-2603, has targeted at least four organizations in Europe, Africa, and Latin America, including a water utility and a telecommunications provider. The attackers exploited vulnerabilities in on-premises Microsoft SharePoint to gain initial access. Over a… 
Critical RCE Vulnerability in Prefab UI Disclosed A critical remote code execution vulnerability, CVE-2026-120338, was disclosed on November 1, 2026, affecting Prefab UI's Generative UI sandbox. The flaw allows attackers to execute arbitrary Python code by exploiting Deno's permissions, enabling file read/write access on the host server. This vulnerability affects…