China-Backed Hackers Launch Ransomware Assault on SharePoint Servers Using ‘ToolShell’ Exploit

Introduction: A New Ransomware Storm Hits SharePoint Systems

In an alarming escalation of cyber threats targeting enterprise infrastructure, a Chinese nation-state group known as Storm-2603 has begun deploying Warlock ransomware through vulnerabilities in on-premises SharePoint servers. These attacks, which are now evolving into a broader campaign involving espionage and data theft, expose a dangerous flaw chain dubbed “ToolShell”. This campaign underscores the urgent need for organizations to secure outdated or unpatched systems.

This surge of activity, revealed by Microsoft in a blog update on June 23, highlights the growing trend of nation-backed threat actors exploiting zero-day vulnerabilities not just for surveillance—but for full-scale ransomware attacks.

Summary: The Rising Threat from Storm-2603 and SharePoint Vulnerabilities

A series of targeted cyberattacks has emerged, led by Chinese state-backed actor Storm-2603, who is exploiting several SharePoint server vulnerabilities to deploy Warlock ransomware. These critical flaws—CVE-2025-49706, CVE-2025-49704, CVE-2025-53770, and CVE-2025-53771—were discovered by a researcher at Viettel Cyber Security and weaponized through an exploit chain known as ToolShell.

These vulnerabilities specifically affect SharePoint Server Subscription Edition, 2019, and 2016, but not SharePoint Online, providing some relief to Microsoft 365 customers. Despite Microsoft’s release of urgent security patches, many organizations remain vulnerable. Notably, even the U.S. Nuclear Weapons Agency was reportedly targeted.

Microsoft observed that while Linen Typhoon and Violet Typhoon, two other Chinese threat actors, focused on espionage and intellectual property theft, Storm-2603 took a different route—launching direct ransomware campaigns using LockBit and now Warlock. Microsoft admitted it cannot fully determine the group’s motives, leaving open whether financial gain, disruption, or hybrid motives are in play.

The typical attack chain involves exploiting the SharePoint flaws, establishing persistence through IIS manipulation, credential dumping with Mimikatz, lateral movement across the network, and ultimately modifying Group Policy Objects (GPOs) to distribute the Warlock ransomware payload.

Microsoft warned that other actors are now joining the fray, leveraging the same unpatched SharePoint flaws to stage their attacks. Defenders are urged to immediately patch systems, rotate server keys, reset IIS services, deploy endpoint protection, and prepare incident response playbooks.

What Undercode Say:

This latest wave of ransomware attacks exposes a dangerous intersection between state-backed cyber warfare and the weaponization of enterprise software flaws. It also highlights a pattern we’ve seen increasingly over the last five years: the blending of espionage, economic sabotage, and ransomware into single attack campaigns.

Storm-2603’s use of the ToolShell exploit chain marks a significant technical advancement. It’s not just a simple backdoor or phishing scheme—this is surgical, stealthy exploitation of on-premises environments that are often overlooked in favor of cloud defenses. Companies focused solely on cloud-based threat vectors may find themselves blindsided by legacy vulnerabilities in on-prem SharePoint infrastructure.

What makes this case particularly unsettling is its unusual complexity and layered motives. While Warlock ransomware indicates financial motives, the shared tools and techniques with espionage-driven actors suggest a hybrid campaign. It’s plausible Storm-2603 is masking its cyber-espionage activities behind ransomware to obscure attribution and deflect attention.

Microsoft’s inability to confirm the group’s intent only underscores the murky nature of modern cyber threats—it’s no longer clear-cut whether a ransomware attack is about money, mayhem, or masked data theft. This uncertainty creates massive complications for incident response teams trying to prioritize defense strategies.

Additionally, the fact that multiple threat actors are now adopting these exploits is a red flag: this could evolve into another EternalBlue-like scenario, where a leaked or discovered vulnerability is recycled across dozens of cybercrime groups for years.

From a geopolitical standpoint, the involvement of a nuclear agency in the U.S. raises the stakes considerably. This is no longer a theoretical risk to enterprises—it’s a national security issue that affects both public and private sectors. The continued success of these attacks hinges not just on technical vulnerabilities but also on the sluggish patching behavior of organizations worldwide.

It’s also worth noting that SharePoint is a core system for document collaboration and internal communication. A compromised SharePoint server could serve as a beachhead to the entire organization, allowing attackers to move laterally, impersonate admins, or inject malicious scripts directly into workflows.

If businesses fail to recognize this risk and leave outdated systems exposed, we are likely to see a cascade of ransomware incidents targeting legal firms, healthcare providers, defense contractors, and governmental bodies—all heavy users of SharePoint.

The bottom line: patching is not optional—it’s survival. If your SharePoint systems are still unpatched, you’re already a target.

🔍 Fact Checker Results

✅ The ToolShell vulnerability chain and its associated CVEs were officially confirmed by Microsoft.

✅ Microsoft disclosed Storm-2603’s ransomware deployment on June 23, citing real-world exploitation against major entities including U.S. infrastructure.

✅ SharePoint Online remains unaffected—only on-premises installations are vulnerable.

📊 Prediction

Based on current threat intelligence and Microsoft’s warnings, it’s highly probable that Storm-2603’s tactics will be adopted by ransomware-as-a-service (RaaS) groups within the next 90 days. As more threat actors obtain proof-of-concept exploit kits for ToolShell, the volume of attacks will spike—especially against small to mid-size enterprises who lack robust SharePoint security protocols.

We also anticipate broader geopolitical repercussions, as the use of ransomware by state-affiliated actors will likely provoke international cyber policy discussions and possibly sanctions against Chinese digital operations. The next stage could include hybrid extortion schemes, combining data theft with ransomware to exert maximum pressure on victims.