A December intrusion to Storm-2603, the China-based group Microsoft ties to Warlock ransomware. The attackers used ToolShell flaws in on-premises SharePoint and ran a memory-only webshell inside the IIS worker process. They then layered several tunnels, including Cloudflare Tunnel, to keep access after the initial foothold was gone. Kaspersky assesses the attribution with moderate confidence. […] The post Storm-2603 Hackers Exploit SharePoint and Abuse Cloudflare Tunnel to Hide Remote Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
First seen on gbhackers.com
Jump to article: gbhackers.com/storm-2603-attack/
