Storm-2603 Exploits SharePoint Flaws to Deploy Warlock Ransomware on Unpatched Systems

Microsoft has revealed that a suspected China-based threat actor, Storm-2603, is actively exploiting critical vulnerabilities (CVE-2025-49706, CVE-2025-49704) in unpatched on-premises SharePoint servers to deploy Warlock ransomware. This sophisticated attack chain involves web shell deployment, disabling security protections, credential harvesting, and lateral movement, ultimately distributing ransomware via Group Policy Objects. The widespread exploitation has already impacted at least 400 victims, underscoring significant cybersecurity risks for organizations with vulnerable SharePoint infrastructure and highlighting the escalating threat from state-linked, financially motivated cyber groups.

Analysis

Microsoft (MSFT) has disclosed a significant, active cybersecurity campaign by a suspected China-based threat actor, Storm-2603, which is exploiting two critical vulnerabilities (CVE-2025-49706 and CVE-2025-49704) in its on-premises SharePoint Server software. The attack, which has already impacted at least 400 victims, culminates in the deployment of Warlock ransomware, indicating a financially motivated operation with a high degree of technical sophistication. The attack methodology involves disabling Microsoft's own Defender protections, harvesting credentials using Mimikatz, and achieving network persistence, underscoring the severity of the threat. The strongly negative sentiment for Microsoft (ticker sentiment: -0.7) reflects the reputational risk associated with a flagship enterprise product being compromised on such a large scale. While Microsoft is actively providing threat intelligence and mitigation guidance, this event highlights the persistent security vulnerabilities in legacy on-premises infrastructure, which could serve as a catalyst for customers to accelerate migration to Microsoft's more secure, higher-margin cloud-based platforms. The involvement of other state-linked groups and China's official denial adds a layer of geopolitical complexity to the incident.

Key Decisions for Investors

• Investors should monitor for any commentary from Microsoft on whether this incident is accelerating the migration of its enterprise customers from on-premises software to its more lucrative cloud services.
• The large-scale exploitation affecting over 400 entities presents a potential tailwind for cybersecurity firms specializing in endpoint detection, incident response, and security consulting services, which will be critical for remediation.
• It is prudent to assess portfolio holdings for their reliance on potentially vulnerable on-premises infrastructure, as this event highlights a material risk of operational disruption and financial loss from ransomware.
• The attribution to a suspected state-linked actor introduces geopolitical risk that could create volatility for technology firms with significant exposure to or reliance on Chinese markets and supply chains.