SmarterTools Breached by Own SmarterMail Vulnerabilities

SmarterTools was breached after an unpatched SmarterMail VM was compromised—attributed to the Storm-2603 actor linked to Warlock ransomware—leveraging CVE-2026-23760 (and probes for CVE-2026-24423); attackers established persistence, often waited ~6–7 days before activating ransomware, targeted Active Directory for lateral movement, and abused legitimate/admin tools (Velociraptor, SimpleHelp, JWRapper, legacy WinRAR, etc.); network segmentation and Linux-heavy infrastructure limited impact and detections by SentinelOne helped prevent widespread encryption.