Storm-2603

Storm-2603 is a threat actor associated with the deployment of Warlock ransomware and tracked under aliases including GOLD SALEM, CL-CRI-1040, and Warlock Group. The actor has been active since at least March 2025, with sustained targeting of vulnerable internet-facing and on-premises enterprise applications, especially Microsoft SharePoint Server. Multiple reports describe Storm-2603 exploiting SharePoint vulnerabilities from mid-2025 onward, including the ToolShell exploit chain, to gain initial access, deploy web shells, steal SharePoint cryptographic material, and establish persistence. The group has also been linked to exploitation of other enterprise software vulnerabilities, including flaws affecting SmarterMail, SolarWinds Web Help Desk, and Gladinet CentreStack, in operations that led to ransomware deployment or extortion activity. Storm-2603’s tradecraft blends vulnerability exploitation with extensive post-compromise abuse of legitimate administrative and remote access tooling. Observed activity includes command execution through IIS worker processes, deployment of web shells, creation of new local and domain administrator accounts, credential theft from LSASS using Mimikatz, lateral movement with PsExec, Impacket, WMI, and WinRM, and ransomware distribution through Group Policy Objects. The actor has repeatedly used legitimate tools and services such as Velociraptor, Cloudflare Tunnels, Zoho Assist, and SSH via Visual Studio Code to maintain redundant access while blending into normal administrative activity. Defense evasion has included disabling security products through registry modification, DLL side-loading, custom backdoors, scheduled tasks, IIS component manipulation, and Bring Your Own Vulnerable Driver techniques using vulnerable kernel drivers to tamper with memory and suppress endpoint protections. Victimology spans commercial enterprises, government entities, and large multinational organizations across North America, Europe, and South America, with additional reporting tying the actor to attacks affecting sectors such as telecommunications, healthcare, finance, education, and critical infrastructure. Public leak-site activity attributed to the Warlock/GOLD SALEM operation indicates a broad extortion model involving data theft, victim shaming, and claimed data sales. The group has publicly listed dozens of victims since 2025 and appears to operate opportunistically against exposed enterprise infrastructure rather than focusing exclusively on a single vertical. Microsoft has assessed Storm-2603 with moderate confidence as a likely China-based threat actor, and some reporting characterizes it as China-based. However, this attribution is not uniformly corroborated across the industry, and at least some researchers have stated that available evidence is insufficient to independently confirm the China nexus. What is well supported is that Storm-2603 is a ransomware and extortion actor with a demonstrated pattern of rapidly operationalizing newly disclosed vulnerabilities in externally exposed enterprise software, particularly on-premises SharePoint, and combining that access with credential theft, stealthy persistence, lateral movement, and ransomware deployment.