File · Storm-2603 · Unknown · assessed origin China · misp-galaxy · refreshed 2026-10-06
Storm-2603
- Longlegs
sigil · no ATT&CK coverage stated
What changed
ledger · newest first- —todaynew CVE2 new CVEs: CVE-2025-49704, CVE-2025-49706
- —10 d agonew alias1 new alias: Longlegs
Analyst brief
misp-galaxyThe group Microsoft tracks as Storm-2603 is assessed with medium confidence to be a China-based threat actor. Microsoft has not identified links between Storm-2603 and other known Chinese threat actors. Microsoft tracks this threat actor in association with attempts to steal MachineKeys via the on-premises SharePoint vulnerabilities.
Although Microsoft has observed this threat actor deploying Warlock and Lockbit ransomware in the past, Microsoft is currently unable to confidently assess the threat actor’s objectives. Additional actors may use these exploits to target unpatched on-premises SharePoint systems, further emphasizing the need for organizations to implement mitigations and security updates immediately.
CVEs Storm-2603 is cited as exploiting
2 on CISA KEV- CVE-2025-49704KEV2026-10-17
“As early as July 7, 2025, Microsoft analysis suggests threat actors were attempting to exploit CVE-2025-49706 and CVE-2025-49704 to gain initial access to target organizations. These actors include Chinese state actors Linen Typhoon and Violet Typhoon and another China-based actor Storm-2603.”
cited as exploiting · source: microsoft.com ↗ · 2026-10-17
- CVE-2025-49706KEV2026-10-17
“As early as July 7, 2025, Microsoft analysis suggests threat actors were attempting to exploit CVE-2025-49706 and CVE-2025-49704 to gain initial access to target organizations. These actors include Chinese state actors Linen Typhoon and Violet Typhoon and another China-based actor Storm-2603.”
cited as exploiting · source: microsoft.com ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Take it with you
keyless · no signupReferences
2 sourcesTrack Storm-2603 on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.