Storm 2603 deployed ransomware through Microsoft SharePoint vulnerabilities

Kaspersky researchers analyzed a complex fileless cyberattack carried out by the hacker group Storm-2603, Securelist reported. The group exploited on-premises Microsoft SharePoint servers using ToolShell vulnerabilities to achieve remote code execution and ultimately deploy ransomware on target systems. [1]

The attack involved the exploitation of two security vulnerabilities identified as CVE-2025-53770 and CVE-2025-53771, according to Securelist. Hackers gained remote code execution on target networks by sending specially crafted HTTP requests to vulnerable systems. Microsoft attributed this ransomware deployment activity specifically to Storm-2603. [1]

Microsoft SharePoint is a web-based collaborative platform introduced in 2001 that organizations use for corporate intranets, document management, and file sharing. While it is widely used as a hosted service within Microsoft 365, organizations can also host it on-premises using SharePoint Server. [4]

Securelist reported that Microsoft distinguished Storm-2603 from other hacking groups that exploited the same ToolShell vulnerabilities in 2025. While other groups used the flaws primarily for credential theft, espionage, and data exfiltration, Storm-2603 focused on ransomware deployment following runtime subversion. [1]