One intrusion, two cyberattackers: Uncovering parallel threat activity

In this DART incident report, responders uncovered a complex, multi-stage intrusion initially identified during a ransomware investigation: Storm-2603 was observed targeting on‑premises SharePoint and conducting reconnaissance for local file inclusion, while a second unrelated actor operated in parallel using DLL sideloading and custom backdoors; attackers used Velociraptor with SYSTEM privileges, created local and domain admin accounts, leveraged Cloudflare tunnels, Zoho Assist, SSH, and a vulnerable driver to evade defenses, and Microsoft DART coordinated containment, telemetry correlation, and remediation guidance to evict adversaries and improve defensive posture.