Storm-2603

Also known as Longlegs

The group Microsoft tracks as Storm-2603 is assessed with medium confidence to be a China-based threat actor. Microsoft has not identified links between Storm-2603 and other known Chinese threat actors. Microsoft tracks this threat actor in association with attempts to steal MachineKeys via the on-premises SharePoint vulnerabilities. Although Microsoft has observed this threat actor deploying Warlock and Lockbit ransomware in the past, Microsoft is currently unable to confidently assess the threat actor’s objectives. Additional actors may use these exploits to target unpatched on-premises SharePoint systems, further emphasizing the need for organizations to implement mitigations and security updates immediately.

Recent activity

• How to detect fileless attacks exploiting ToolShell: analyzing the Storm-2603 incident
  reddit · Nov 6, 2026
• The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603 Kaspersky researchers analyse a complex fileless intrusion by the threat a
  mastodon · Nov 5, 2026
• New. Kaspersky: The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603 https:// securelist.com/storm-2603-file less-toolshell-att
  mastodon · Nov 5, 2026
• The VS Code tunnel gap from my Warlock thread is closed: https:// infosec.exchange/@josehelps/11 7389116133373301 LOLRMM now has a VS Code Remote Tunnels entry.
  mastodon · Oct 31, 2026

References

• https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/
• https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.