#Storm-2603

This archive brings together reporting on activity attributed to Storm-2603, with emphasis on intrusion techniques, attack vectors, and indicators of compromise tied to campaigns observed across the region. It also includes attribution analysis, defensive responses, and the security implications for teams operating in Latin America.

Warlock exploited SharePoint in critical attacks

Symantec tied Warlock to a SharePoint on-prem intrusion that stole ASP.NET keys, disabled defenses and spread through SYSVOL.

Oct 21, 2026 · 38 min