ChinaAssessedChina-basedMixedActive 2025 – 2026Storm-2603
Also known asLonglegs
Summary
China-based actor (Microsoft, moderate confidence) that Microsoft could not link to any other known Chinese group, and whose objectives it could not confidently assess: Microsoft tracks it in association with attempts to steal SharePoint MachineKeys, and it has deployed ransomware. From 18 July 2025 Microsoft saw it exploit the on-premises SharePoint 'ToolShell' chain (CVE-2025-49706, CVE-2025-49704) through the spinstall0.aspx web shell (T1190, T1505.003), persist with scheduled tasks (T1053.005), dump LSASS with Mimikatz (T1003.001), move laterally with PsExec, Impacket and WMI (T1047), and push Warlock ransomware through modified Group Policy Objects (T1484.001, T1486). Check Point traced its infrastructure back to March 2025 operations that deployed LockBit Black and Warlock/x2anylock alongside a custom AK47 C2 framework (ak47http / ak47dns) and a BYOVD antivirus killer, likely against organisations in Latin America and Asia-Pacific in the first half of 2025.
Attribution
Microsoft, moderate confidence; no link to other Chinese actors found
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- Microsoft Threat Intelligence (Research, 2025-07-22)
Assessed with moderate confidence to be a China-based actor - Microsoft (Research, 2026-10)
Listed with origin China in the naming table
Campaigns 3
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Warlock against a water utility, a telecom operator, a regional government and a university | 2026-08 – 2026-09 | Europe, Africa, Latin America | Water/Wastewater, Telecommunications, Government, Academia | Symantec Threat Hunter Team (2026-10-01) — "in the past two months"; victims in Portuguese- and Spanish-speaking countries |
| SharePoint 'ToolShell' exploitation (CVE-2025-49706 / CVE-2025-49704) — MachineKey theft attempts and Warlock ransomware via GPO | 2025-07 | Global | Multiple | Microsoft Threat Intelligence (2025-07-22, updated 2025-07-23) |
| Earlier ransomware operations — LockBit Black and Warlock/x2anylock with the AK47 C2 frameworkASSESSED | 2025-03 – 2025-06 | Latin America, Asia-Pacific | Multiple | Check Point Research (2025-07) — "likely", from VirusTotal data and shared infrastructure |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 7
| Initial Access1 | T1190Exploit Public-Facing Application |
|---|---|
| Execution1 | T1047Windows Management Instrumentation |
| Persistence2 | T1505.003Web ShellT1053.005Scheduled Task |
| Privilege Escalation1 | T1484.001Group Policy Modification |
| Credential Access1 | T1003.001LSASS Memory |
| Impact1 | T1486Data Encrypted for Impact |
Malware and tools 2
| Name | Description | Platform |
|---|---|---|
| Warlock | Ransomware (x2anylock) | Windows |
| AK47 C2 | Custom C2 framework (ak47http / ak47dns backdoors) | Windows |
Exploited vulnerabilities 2
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2025-49704 | 8.8 | Microsoft SharePoint Server — code injection RCE, ToolShell chain (KEV 2025-07-22) |
| CVE-2025-49706 | 6.5 | Microsoft SharePoint Server — spoofing / authentication bypass, ToolShell chain (KEV 2025-07-22) |
Highest CVSS first.
Infrastructure patterns
- spinstall0.aspx web shell on on-premises SharePoint to read MachineKey material (Microsoft 2025)
- BYOVD antivirus terminator (VMToolsEng.exe + ServiceMouse.sys) before ransomware (Check Point 2025)
- Visual Studio Code tunnelling for covert remote access (Symantec, 2026)
Reporting and advisories 3
- Microsoft Threat Intelligence
Disrupting active exploitation of on-premises SharePoint vulnerabilities (Storm-2603, Warlock), Jul 2025 - Check Point Research
Before ToolShell: Exploring Storm-2603's Previous Ransomware Operations (Jul 2025) - Symantec Threat Hunter Team
Warlock ransomware attackers hit water and telecom operators (Oct 2026)