Storm-2603
Storm-2603 is a China-attributed cybercrime syndicate with a financial motive, tracked by Brandefense. It targets 3 sectors, including Government and Technology. It uses 36 MITRE ATT&CK techniques and exploits 4 known CVEs.
- Warlock ransomware
- CL-CRI-1040
- Origin
- China
- Techniques
- 36
- Exploited CVEs
- 4
- First seen
- Jun 1, 2025
- Last seen
- Dec 15, 2025
- Record updated
Who They Target.
About Storm-2603.
The cluster operates Warlock ransomware, publicly advertised on criminal forums from early June 2025, and has been associated with exploitation of on-premises Microsoft SharePoint ToolShell vulnerabilities (CVE-, CVE-, CVE-, CVE-) for initial access, followed by credential theft, lateral movement, defense evasion, data exfiltration, and encryption. Microsoft assesses the actor as China-based with moderate confidence; that location assessment remains vendor-claimed. Primary observed objective is financial extortion via Warlock ransomware, with some vendor commentary also noting dual-use access motives. already contains thin Storm-2603, GOLD SALEM, and Warlock shells that require alias merge and field repair rather than new duplicate operators.
Last updated Aug 6, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.