ToolShell under siege: Check Point analyzes Chinese APT Storm-2603

Check Point and related reporting detail Storm-2603, a China-linked threat cluster that exploited four SharePoint vulnerabilities to deploy custom AK47 C2 backdoors (AK47HTTP and AK47DNS). The actors used DNS tunneling and HTTP-based C2, sideloaded DLLs, and leveraged a signed Antiy Labs driver (ServiceMouse.sys) and an Antivirus Terminator tool to kill security processes, ultimately deploying multiple ransomware variants including LockBit Black and Warlock against targets in Latin America and APAC in 2025.