Skip to content

Storm-2603

Named by 2 kept items in this workspace.

Search every workspace for Storm-2603. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • Velociraptor Misuse, Pt. II: The Eye of the Storm
    writeup2025-12-03

    Financially motivated threat cluster identified via a hostname (DESKTOP-C1N9M) match to a Singapore government security advisory from August; since July has used ToolShell to exploit SharePoint servers before dropping web shells and DLL side-loaded loaders and deploying Warlock ransomware

  • Velociraptor WSUS Exploitation, Pt. I: WSUS-Up?
    writeup2025-11-20

    Threat actor Cisco Talos attributed (medium confidence) to Velociraptor activity found in October; initial access vector likely SharePoint ToolShell vulnerabilities, based on the impacted organization's exposure to ToolShell and the link to Storm-2603

All threat actors in this workspace.