Quick summary: DART (Microsoft's Detection and Response Team) investigated and published a ransomware intrusion report, actively targeting internet-facing, on-premises SharePoint servers. During the investigation, a second threat actor was found operating in the same environments simultaneously, suggesting an overlap in attack campaigns.
What Happened
Threat actor identified as China-based Storm-2603 has been targeting SharePoint servers since (at least) mid-2025. The attack exploited two known vulnerabilities:
- CVE-2025-49706: improper Microsoft Office SharePoint authentication allows attackers to perform spoofing over a network
- CVE-2025-49704: code injection in Microsoft Office SharePoint, allowing attackers to execute code over a network
Post-intrusion, Storm-2603 searched for additional entry points through reconnaissance activity, including requests for sensitive configuration files. In this case, win.ini and web.config.
The attack was executed in three stages:
1. The group used Velociraptor with SYSTEM-level privileges to map the environment, deliberately blending malicious activity with trusted administrative behavior.
2. Remote access was then established through multiple channels: Cloudflare tunnelling, Zoho Assist, and SSH connections configured through Visual Studio Code.
3. Privilege escalation followed, with new local and domain administrator accounts created to maintain access.
As DART investigated, they uncovered a second, unrelated threat actor operating in parallel. This actor used two techniques not associated with Storm-2603.
- DLL side loading, to place malicious code inside legitimate Windows system files, so it executes under the cover of a trusted process
- Custom backdoors; purpose-built tools designed to maintain hidden access that standard security tools are unlikely to recognize
Both techniques are engineered for stealth, obscuring the presence of the second actor. At the time of writing, the second actor has not been identified.
One attacker getting in is bad enough.
Two, operating independently, in the same compromised environment, is a different problem entirely, suggesting that the moment a vulnerability is disclosed, multiple threat actors will race to exploit it. Storm-2603 may have been the first to exploit the two CVEs, but they weren't the last; and they almost certainly won't be the only group going forward.
The report doesn’t confirm the two actors were connected or coordinating. But intentionally or not, they were obscuring each other via two sets of malicious activity layered into the same environment.
Who Is Affected
Based on Microsoft’s report, the intrusion affected at least two organizations. Forensic evidence of lateral movement led DART to identify and engage a second victim, which was confirmed to have been compromised by the same ransomware activity as the first.
No further organizations have been confirmed as compromised yet.
However, any organization running on-premises SharePoint servers that has not applied Microsoft's security updates for CVE-2025-49706 and CVE-2025-49704 remains exposed to the same attack vector.
Microsoft Recommendations
In their report, DART recommended a series of remediation steps and security policies, addressing the full attack surface Storm-2603 exploited. Orgs running on-premises SharePoint servers should treat the following as a baseline.
- Patch internet-facing systems promptly, prioritizing critical infrastructure
- Establish a continuous process to identify, assess, and remediate vulnerabilities. Validate that updates have been applied
- Treat high-privilege identities as a primary attack surface: enforce strong identity controls and monitor privileged sign-ins
- Implement conditional access and identity protection to detect anomalous authentication activity early
- Deploy endpoint protection solutions across the entire environment
- Retain telemetry centrally (for example, in a SIEM) to support investigation, correlation, and timeline reconstruction
- Implement continuous monitoring and long-term log retention to surface malicious activity and enable complete investigations
- Audit and approve all remote management software, tunnelling utilities, and developer tooling in use. Monitor for atypical usage
- Develop predefined incident response playbooks, test them regularly, and ensure teams are prepared to act quickly
- Ensure compromised credentials, devices, and access paths can be rapidly isolated to limit lateral movement
Why the Attack Was Difficult to Detect
The attackers were methodical about the intrusion, knowing which tools security teams trust, which processes blend into normal administrative behavior, and how to stay hidden longer.
Abuse of Legitimate Tools
The attackers deliberately used software that would not inherently trigger security alerts. Velociraptor is a legitimate forensic tool; Cloudflare, Zoho Assist, and Visual Studio Code are all widely used applications. An antivirus engine scanning for known malicious software would have no obvious reason to flag these.
Active Disabling of Endpoint Protections
The report states the threat actor loaded a vulnerable driver (NSecKrnl.sys) to tamper with memory and disable endpoint protections. This means security tools were actively neutralized before they could detect subsequent activity.
Specific Camouflage
Looking at the activities uncovered by Microsoft, stated in their official report, the second actor hid malicious code inside legitimate processes. The trojan horse technique camouflaged the code, making it harder to distinguish from normal system activity.
The Attacker’s Advantage
One attack doesn't tell you the whole story of a breach. Therefore, patching and moving on might not be the end of Storm-2603 exploits.
Two attackers, infiltrating through two different methods, in the same environment, means single-layer defense was never going to be enough. It also means there's no real way to estimate how many other systems, right now, are already breached, with an actor inside choosing to stay hidden. Patching closes the loophole that was exploited, but it doesn’t do anything for what may already lie dormant in your SharePoint libraries.
What’s in your control is ensuring your data inside is as hard to reach, move, and weaponize as possible.
Start at the file level with MetaDefender Storage Security and build from there.
