Storm-2603 Using Custom Malware That Leverages BYOVD to Tamper with Endpoint Protections

Storm-2603 is a newly identified ransomware-focused threat actor that exploited multiple SharePoint Server CVEs to gain access, uses a custom Command-and-Control framework ('ak47c2' with ak47http and ak47dns), and employs an 'Antivirus Terminator' BYOVD tool that leverages a signed vulnerable driver to neutralize endpoint protections. The group has deployed multiple ransomware families (LockBit Black, Warlock), used DLL hijacking for execution, and targeted organizations across Latin America and the Asia-Pacific region during 2025.