CVE-2025-11371: Gladinet Triofox Critical Vulnerability
A critical flaw (CVSS 9.1) in Gladinet Triofox exploited by Storm-2603 for initial access in ransomware attacks. Used to probe for local…
Tag: Storm-2603
Storm-2603: Threat Actor Deploying Warlock Ransomware via SharePoint Exploits
A threat actor known for deploying Warlock ransomware by exploiting vulnerabilities in on-premises SharePoint servers since mid-2025. Uses tools like Velociraptor, Cloudflare…
Warlock Ransomware: Deployed by Storm-2603 in SharePoint Attacks
Ransomware deployed by threat actor Storm-2603, often exploiting known vulnerabilities in on-premises SharePoint servers. Used in parallel with other techniques to establish…
Gladinet: Triofox Product Exploited via CVE-2025-11371
Gladinet's Triofox product was exploited via CVE-2025-11371 (CVSS 9.1) by Storm-2603 for initial access, probing for local file inclusion.
Velociraptor: Tool Used by Storm-2603 to Blend Malicious Activity
Velociraptor was deployed by Storm-2603 to blend malicious activity with trusted administrative behavior during ransomware attacks.
NSecKrnl.sys: Vulnerable Driver Used to Tamper with Endpoint Security
A vulnerable driver (NSecKrnl.sys) was used by Storm-2603 as a conduit to tamper with endpoint security protections and reduce visibility.
Gladinet Triofox: Exploited via CVE-2025-11371 for Initial Access
Gladinet Triofox was exploited via CVE-2025-11371 (CVSS 9.1) by Storm-2603, allowing probing for local file inclusion.
SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity remote code execution vulnerability, CVE-2026-45659 (CVSS 8.8), affecting Microsoft SharePoint…
Zoho Assist: Remote Access Tool Abused by Storm-2603
Zoho Assist was used by Storm-2603 as one of multiple remote access channels during ransomware attacks, alongside Cloudflare tunneling and SSH.