Parallel intrusions were identified in on-premises Microsoft SharePoint environments via the exploitation of CVE-2025-49704, CVE-2025-49706, and CVE-2025-53770. Two distinct threat actors operated concurrently: Storm-2603, a ransomware group utilizing BYOVD and legitimate remote tools, and an unattributed actor focused on Active Directory (AD) credential theft via DLL sideloading and custom backdoors. This overlapping activity created significant "signal noise," complicating forensic detection and containment. The intrusions highlight a critical failure in patching internet-facing legacy infrastructure, enabling both immediate financial extortion and long-term espionage within the same network perimeter.

• Incident Overview: Parallel Compromise

  • Simultaneous operations by two unrelated threat actors within a single compromised environment.
  • Initial access achieved through unpatched, internet-facing on-premises Microsoft SharePoint servers.
  • Discovery occurred during a ransomware engagement by the Microsoft Detection and Response Team (DART).

• Storm-2603: Ransomware Mechanics

  • Utilized legitimate tools including Cloudflare Tunnel, Zoho Assist, and Visual Studio Code Remote SSH for C2 and persistence.
  • Employed Bring Your Own Vulnerable Driver (BYOVD) techniques to disable endpoint security controls.
  • Focused on unauthorized administrator account creation followed by rapid ransomware deployment.

• Unattributed Actor: Stealth & Espionage

  • Implemented DLL sideloading and deployed custom backdoors to maintain a low-profile presence.
  • Leveraged Virtual Private Server (VPS) infrastructure for VPN access to mask origin and lateral movement.
  • Targeted Active Directory credential databases, indicating a primary objective of long-term espionage.

• Operational Risks & Containment Challenges

  • "Signal Noise" Phenomenon: The loud activity of Storm-2603 effectively masked the stealthy TTPs of the second actor.
  • High Containment Risk: Evicting one actor may inadvertently alert the second, potentially triggering immediate data destruction or accelerated exfiltration.
  • Systemic Spread: Investigation confirmed lateral movement across multiple organizations, proving the scalability of the attack chain.

• Defensive Recommendations & Root Cause

  • Primary Root Cause: Failure to patch critical, internet-facing legacy infrastructure and inadequate monitoring of privileged identities.
  • Urgent Remediation: Immediate patching of SharePoint vulnerabilities CVE-2025-49704, CVE-2025-49706, and CVE-2025-53770.
  • Strategic Shift: Implementation of strict identity monitoring and behavioral analysis to detect concurrent, overlapping intrusions.