Storm-2603

Reports per quarter

Techniques seen in the last two years

• T1003.001 2 reports
• T1005 2 reports
• T1033 2 reports
• T1047 2 reports
• T1053.005 2 reports
• T1059.001 2 reports
• T1059.003 2 reports
• T1090 2 reports
• T1112 2 reports
• T1119 2 reports

Counts come from technique IDs in the actor's report text.

CVEs named in reports

• CVE-2025-49704 KEV ransomware
• CVE-2025-49706 KEV ransomware
• CVE-2025-53770 KEV ransomware
• CVE-2025-53771
• CVE-2025-59287 KEV

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 6 April 2026

   Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12)

   date ORKL added it fromORKL

   Archived copy on ORKL Detailsfor Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief (Updated August 12)

2. 6 April 2026

   Disrupting active exploitation of on-premises SharePoint vulnerabilities

   date ORKL added it fromORKL

   Archived copy on ORKL Detailsfor Disrupting active exploitation of on-premises SharePoint vulnerabilities

3. 22 July 2025

   Disrupting active exploitation of on-premises SharePoint vulnerabilities | Microsoft Security Blog

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Disrupting active exploitation of on-premises SharePoint vulnerabilities | Microsoft Security Blog

Newest first. Details opens the report in Explore.