One intrusion, two cyberattackers: Uncovering parallel threat activity

1. Executive summary

Microsoft's Detection and Response Team (DART) responded to a multi-stage intrusion in which two unrelated threat actors operated in parallel inside the same environment, masking each other's activity. The primary actor, Storm-2603 (attribution unconfirmed — no MITRE ATT&CK profile exists for this group), has been targeting on-premises Microsoft SharePoint servers since mid-2025, exploiting known vulnerabilities and probing for local file inclusion (LFI) weaknesses via requests for win.ini and web.config. After gaining access, the actor deployed the legitimate Velociraptor forensic tool with SYSTEM privileges, established remote access via Cloudflare tunneling, Zoho Assist, and SSH through Visual Studio Code, created new local and domain administrator accounts, and abused a vulnerable driver to tamper with memory and disable endpoint protections. A second, unrelated actor added DLL sideloading and custom backdoors on top. For EMEA financial services firms running on-premises SharePoint, the bottom-line risk is internet-facing SharePoint exposure combined with weak identity hygiene — the same preconditions that enabled this intrusion.

2. Regulatory framing

3. Technical analysis & attack chain

1. Initial access — on-premises SharePoint (since mid-2025). Storm-2603 targeted on-premises SharePoint servers, exploiting known vulnerabilities. Microsoft does not name the specific CVEs in this report.
2. Reconnaissance for additional entry points. Requests for win.ini and web.config were observed — classic LFI probing patterns. Exploitation was not confirmed; the activity is assessed as reconnaissance for entry points.
3. Tool deployment — Velociraptor with SYSTEM privileges. The actor deployed Velociraptor (a legitimate open-source forensic/IR tool) at SYSTEM level to map the environment and operate with high privileges, blending malicious activity with trusted administrative behaviour.
4. Remote access channels. Multiple parallel channels were established: - Cloudflare Tunnel (cloudflared) for outbound C2. - Zoho Assist for remote support/control. - SSH via Visual Studio Code (the VS Code remote-SSH capability) for interactive access.
5. Privilege escalation and persistence. New local administrator and domain administrator accounts were created to maintain access.
6. Defence evasion. A vulnerable (BYOVD-style) driver was loaded to tamper with memory and disable endpoint protections, reducing visibility.
7. Parallel second actor. A second, unrelated actor introduced malicious DLL sideloading and custom backdoors — techniques not associated with Storm-2603 — adding an additional layer of complexity and obscuring attribution.
8. Containment. DART correlated telemetry across identities, endpoints, and cloud resources, ran a structured response playbook, and coordinated daily with the customer.

Unconfirmed / single-sourced caveats.

• The specific SharePoint CVEs exploited are not disclosed in this report; treat any public "Storm-2603 CVE" claims as unverified until Microsoft publishes the full report.
• Attribution to "Storm-2603" is unconfirmed — Microsoft has no MITRE ATT&CK profile for this actor in the verified reference data, and the cluster name appears to be Microsoft's internal designation.
• The second actor's tooling (custom backdoors, DLL sideloading payloads) is not described in this summary; specific hashes, names, and C2 infrastructure are not available.

4. Mitigation & containment

P1 — within 24 hours

• Inventory and isolate every on-premises SharePoint farm; identify internet-facing SharePoint endpoints and place behind WAF/IPS rules blocking anomalous requests for win.ini, web.config, and other LFI markers.
• Hunt for new accounts. Enumerate local Administrators and privileged groups (Domain Admins, Enterprise Admins, Schema/Admins) for any accounts created since mid-2025; disable and investigate any unknown entries. Reset credentials for any account that touched a SharePoint server in the same window.
• Block known abused tools at the egress. Deny outbound to Cloudflare Tunnel (*.trycloudflare.com, cloudflared binary execution), Zoho Assist (*.zohoassist.com, *.zoho.com/assist), and alert on code.exe (VS Code) launching SSH child processes from non-admin hosts.
• Audit Velociraptor presence. Search endpoints for Velociraptor binaries, services, and scheduled tasks; treat any unsanctioned deployment as a critical incident and isolate the host.
• Audit BYOVD exposure. Identify any unsigned or vulnerable kernel drivers loaded since mid-2025; block known vulnerable driver hashes via WDAC/HVCI/AppLocker and review driver-load telemetry.

P2 — within 72 hours

• Patch and harden SharePoint. Apply the latest SharePoint cumulative updates; if a specific CVE is suspected, pin to a fixed version once Microsoft publishes guidance. Disable unnecessary SharePoint features and tighten file-access policies.
• Identity hardening. Enforce phishing-resistant MFA for all SharePoint admins; rotate SharePoint service accounts, farm account, and any account with SharePoint admin role. Review Kerberos delegation settings on SharePoint app pools.
• Network containment. Restrict SharePoint management ports (e.g., SharePoint Central Administration, default 80/443) to jump hosts; segment SharePoint servers from the rest of the domain where feasible.
• EDR tuning. Add detection content for Velociraptor service installation, Cloudflared execution, and VS Code-launched SSH sessions; alert on new local/domain admin group membership changes.

P3 — within 7 days

• Vulnerability management review. Confirm SharePoint is included in the regular patch cycle with defined SLAs; validate that internet-facing systems are scanned and patched within policy.
• Logging and telemetry. Ensure SharePoint ULS, IIS, and Security event logs are forwarded to SIEM with at least 180 days retention; add correlation rules for LFI probing patterns (win.ini, web.config, ..%5c, etc.).
• Tabletop and lessons-learned. Run a post-incident review covering the parallel-actor scenario; update the incident response playbook to include "second actor masking" play.

5. Indicators of compromise

tool       Velociraptor (deployed with SYSTEM privileges)
tool       Cloudflare Tunnel (cloudflared)
tool       Zoho Assist
tool       Visual Studio Code (SSH remote sessions)
technique  LFI probing via requests for win.ini and web.config
technique  BYOVD vulnerable driver loaded to tamper with memory and disable protections
technique  DLL sideloading with custom backdoors (second actor)

6. Detection

rule AT_Storm2603_SharePoint_TTPs_2026
{
    meta
    {
        author      = "Adverse Trace"
        date        = "2026-06-22"
        description = "Detects artefacts and behaviours associated with Storm-2603 activity against on-premises SharePoint (Microsoft DART, June 2026)"
        reference   = "https://www.microsoft.com/en-us/security/blog/2026/06/22/one-intrusion-two-cyberattackers-uncovering-parallel-threat-activity/"
    }

    strings:
        $a1 = "win.ini" ascii wide nocase
        $a2 = "web.config" ascii wide nocase
        $b1 = "cloudflared" ascii wide nocase
        $b2 = "trycloudflare.com" ascii wide nocase
        $c1 = "zohoassist" ascii wide nocase
        $c2 = "zoho.com" ascii wide nocase
        $d1 = "Velociraptor" ascii wide nocase
        $d2 = "velociraptor" ascii wide nocase
        $e1 = "code.exe" ascii wide nocase
        $f1 = "ssh" ascii wide nocase

    condition:
        2 of ($a*) or 1 of ($b*) or 1 of ($c*) or 1 of ($d*) or (1 of ($e*) and 1 of ($f*))
}

title: New Local or Domain Administrator Account Created on SharePoint Server
id: AT-2026-06-22-135-001
status: experimental
description: >
    Detects creation of new local or domain administrator accounts on SharePoint servers,
    matching Storm-2603 persistence tradecraft observed by Microsoft DART in June 2026.
author: Adverse Trace
date: 2026-06-22
references:

    - https://www.microsoft.com/en-us/security/blog/2026/06/22/one-intrusion-two-cyberattackers-uncovering-parallel-threat-activity/
logsource:
    product: windows
    service: security
detection:
    selection_event:
        EventID:

            - 4720  # user account created
            - 4732  # member added to security-enabled local group
            - 4756  # member added to security-enabled universal group
    selection_group:
        TargetUserName|contains:

            - "Administrators"
            - "Domain Admins"
            - "Enterprise Admins"
            - "Schema Admins"
    selection_sharepoint_host:
        WorkstationName|contains:

            - "SharePoint"
            - "SP-"
            - "WSS"
    condition: selection_event and (selection_group or selection_sharepoint_host)
falsepositives:

    - Legitimate SharePoint farm provisioning by authorised administrators
level: high
tags:

    - attack.persistence
    - attack.t1136
    - attack.privilege_escalation

title: Velociraptor or Cloudflared Execution on SharePoint Server
id: AT-2026-06-22-135-002
status: experimental
description: >
    Detects execution of Velociraptor, cloudflared, or VS Code-launched SSH on SharePoint hosts,
    matching Storm-2603 tradecraft observed by Microsoft DART in June 2026.
author: Adverse Trace
date: 2026-06-22
references:

    - https://www.microsoft.com/en-us/security/blog/2026/06/22/one-intrusion-two-cyberattackers-uncovering-parallel-threat-activity/
logsource:
    product: windows
    service: security
detection:
    selection_process:
        EventID: 4688
        Image|endswith:

            - "\\Velociraptor.exe"
            - "\\cloudflared.exe"
            - "\\code.exe"
    selection_cmdline_velociraptor:
        ParentImage|endswith: "\\Velociraptor.exe"
    selection_cmdline_cloudflared:
        CommandLine|contains:

            - "tunnel"
            - "trycloudflare"
    selection_cmdline_vscode_ssh:
        CommandLine|contains:

            - "code.exe"
            - "ssh"
    selection_sharepoint_host:
        Computer|contains:

            - "SharePoint"
            - "SP-"
            - "WSS"
    condition: selection_process and (selection_cmdline_velociraptor or selection_cmdline_cloudflared or selection_cmdline_vscode_ssh or selection_sharepoint_host)
falsepositives:

    - Authorised IR or admin activity
level: high
tags:

    - attack.execution
    - attack.t1059
    - attack.command_and_control
    - attack.t1071

7. Sources

• Microsoft Security Blog — One intrusion, two cyberattackers: Uncovering parallel threat activity — https://www.microsoft.com/en-us/security/blog/2026/06/22/one-intrusion-two-cyberattackers-uncovering-parallel-threat-activity/ — 2026-06-22

8. Adverse Trace position

Severity: High. The intrusion combines internet-facing SharePoint exploitation, abuse of legitimate admin tooling (Velociraptor, Cloudflare Tunnel, Zoho Assist, VS Code SSH), BYOVD defence evasion, and creation of new domain administrator accounts — a credible precursor to ransomware deployment. Attribution to "Storm-2603" is unconfirmed (no MITRE ATT&CK profile exists for this cluster in the verified reference data); the second actor is unattributed. For EMEA financial services firms running on-premises SharePoint, we assess this as a priority hunt target: any internet-exposed SharePoint farm should be treated as potentially compromised pending review, and identity hygiene (privileged groups, service accounts, MFA on SharePoint admins) should be re-validated within 24 hours. Next steps: Adverse Trace will (1) monitor Microsoft's full report for disclosed CVEs and update this advisory with concrete patch guidance, (2) refresh detection content against any newly disclosed IOCs, and (3) brief affected clients on a case-by-case basis as SharePoint-version and exposure data becomes available.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.