FlagThis

Abstract

Microsoft Incident Response (DART) investigated a ransomware intrusion attributed to Storm-2603 that revealed a more complex campaign involving parallel activity from a second, unrelated threat actor. The case demonstrates that modern attacks can be overlapping campaigns requiring coordinated visibility across multiple organizations and telemetry sources to fully uncover.