Email Under Siege: Storm-2603 Exploits SmarterMail to Deploy Warlock Ransomware

ReliaQuest reports that Storm-2603 is actively exploiting a SmarterMail authentication-bypass vulnerability (CVE-2026-23760) — alongside a separately exploited RCE (CVE-2026-24423) — to reset admin credentials, abuse the software's Volume Mount feature for privileged command execution, deploy Velociraptor for persistence, and stage Warlock ransomware; rapid patch-to-exploit timelines and recommended mitigations (upgrade to Build 9511+, segmentation, and strict outbound firewalling) are emphasized.