Storm-2603 Leverages Custom Malware and BYOVD to Evade Endpoint Protections

Check Point Research attributes a sophisticated campaign to Storm-2603, a Chinese APT active in Latin America and Asia-Pacific in 2025, which leverages a legitimately signed Antiy driver (renamed ServiceMouse.sys) via BYOVD to disable endpoint protections, deploys a custom ak47c2 C2 (HTTP/DNS) with encrypted communications, and simultaneously distributes multiple ransomware families (e.g., LockBit Black, Warlock/x2anylock) using techniques like DLL hijacking, lateral movement tools (PsExec, masscan), and provides numerous indicators (domains and file hashes).