Understanding the Threat Landscape: Storm-2603 and AK47 C2

Introduction to the Threat

Recent findings have brought to light a significant security threat stemming from the exploitation of vulnerabilities within Microsoft SharePoint Server. The perpetrators, linked to a group known as Storm-2603, are employing a sophisticated command-and-control framework referred to as AK47 C2. This development is critical for organizations relying on SharePoint, especially in safeguarding against evolving cyber threats.

The AK47 C2 Framework

The AK47 C2 framework consists of two distinct types of clients: AK47HTTP and AK47DNS. These variants utilize different protocols for communication, making it more challenging for cybersecurity measures to detect and respond to attacks. According to Check Point Research, this framework has been tailored to enhance the group’s operational effectiveness, allowing for nuanced control over compromised systems.

Attribution and Targeting

Storm-2603 has been identified as a potential state-sponsored group operating from China. Microsoft attributes this activity to the exploitation of two specific vulnerabilities in SharePoint: CVE-2025-49706 and CVE-2025-49704, commonly referred to as ToolShell. These flaws have been leveraged to deploy Warlock ransomware, indicating a troubling shift in the tactics used by such threat actors.

Historical Context of Activities

Investigations reveal that Storm-2603 may have been active since March 2025, utilizing varied ransomware families such as LockBit Black and Warlock. This dual deployment is uncommon among established e-crime groups, as it suggests a sophisticated operational capability. Check Point Research notes that the group has actively targeted organizations in both Latin America and the Asia-Pacific (APAC) region, reflecting a broad geographical focus.

Tools of the Trade

The tools employed by Storm-2603 span a range of legitimate and open-source utilities, including masscan, WinPcap, and PsExec. Additionally, they use a custom backdoor known as dnsclient.exe, which communicates through DNS queries to a designated domain (update.updatemicfosoft[.]com). These tools facilitate information gathering and help execute commands covertly on infected machines, showcasing the group’s advanced operational techniques.

Attack Mechanisms and Payloads

The operational methods of Storm-2603 utilize various payload mechanisms. Key artifacts discovered on platforms like VirusTotal include:

• 7z.exe and 7z.dll: Legitimate binaries used to sideload malicious components that deliver Warlock ransomware.
• bbb.msi: An installer that employs a technique to sideload DLL files, contributing to the execution of LockBit Black.
• Additional MSI artifacts have also been discovered, capable of launching both Warlock and LockBit while deploying a custom antivirus killer executable, named VMToolsEng.exe. This tool employs the bring your own vulnerable driver (BYOVD) approach to disable security software.

Motivations Behind the Attacks

While it remains unclear whether the motivations of Storm-2603 are primarily espionage or profit-driven, there are indications that both may be at play. Historically, nation-state actors from countries like China and Iran have engaged in ransomware operations, complicating the motives behind such cyber intrusions. As noted by Sergey Shykevich, a Threat Intelligence Group Manager, the group could represent a hybrid threat combining espionage with financial incentives.

Evolving Cyber Threats

The operational patterns of Storm-2603 illustrate a significant trend in cyber threats, where the lines between advanced persistent threats (APTs) and financially motivated cybercrime are increasingly blurred. The use of both sophisticated hacking techniques and open-source tools indicates a hybrid approach, raising concerns for organizations seeking to fortify their cybersecurity measures.

As cyber threats evolve, understanding the tactics, techniques, and targets of groups like Storm-2603 becomes essential for organizations to effectively safeguard their assets and data. The landscape is changing rapidly, making vigilance and proactive defense strategies more crucial than ever.