{"id":7189,"date":"2025-07-24T20:00:46","date_gmt":"2025-07-25T00:00:46","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=7189"},"modified":"2025-07-24T19:36:52","modified_gmt":"2025-07-24T23:36:52","slug":"storm-2603-hits-sharepoint-servers-with-ransomware-u-s-energy-dept-confirms-breach","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/storm-2603-hits-sharepoint-servers-with-ransomware-u-s-energy-dept-confirms-breach\/","title":{"rendered":"Storm-2603 hits SharePoint servers with ransomware; U.S. energy dept confirms breach"},"content":{"rendered":"<p><a href=\"https:\/\/www.microsoft.com\/en-ph\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Microsoft<\/a> says the Storm-2603 threat group is using <a href=\"https:\/\/hostingdiscussion.com\/news\/sharepoint-servers-under-siege-as-zero-day-exploit-bypasses-mfa-protections\/\">SharePoint flaws<\/a> to launch Warlock ransomware attacks. The group disables Microsoft Defender, steals credentials with Mimikatz, and spreads across networks via PsExec and WMI. More than 400 organizations\u2014including the U.S. Energy Department and the NNSA\u2014have suffered breaches. Microsoft urges admins to patch vulnerable SharePoint servers now, warning that more attackers are already exploiting the same public proof-of-concept exploits.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Microsoft says the Storm-2603 threat group is using SharePoint flaws to launch Warlock ransomware attacks. The group disables Microsoft Defender, steals credentials with Mimikatz, and spreads across networks via PsExec and WMI. More than 400 organizations\u2014including the U.S. Energy Department and the NNSA\u2014have suffered breaches. Microsoft urges admins to patch vulnerable SharePoint servers now, warning [&hellip;]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[140,321,4065,4067,4066],"class_list":["post-7189","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-microsoft","tag-sharepoint","tag-storm-2603","tag-u-s-energy-department","tag-warlock-ransomware-attacks"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Storm-2603 hits SharePoint servers with ransomware; U.S. energy dept confirms breach - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/storm-2603-hits-sharepoint-servers-with-ransomware-u-s-energy-dept-confirms-breach\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Storm-2603 hits SharePoint servers with ransomware; U.S. energy dept confirms breach - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"Microsoft says the Storm-2603 threat group is using SharePoint flaws to launch Warlock ransomware attacks. The group disables Microsoft Defender, steals credentials with Mimikatz, and spreads across networks via PsExec and WMI. More than 400 organizations\u2014including the U.S. Energy Department and the NNSA\u2014have suffered breaches. Microsoft urges admins to patch vulnerable SharePoint servers now, warning [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/storm-2603-hits-sharepoint-servers-with-ransomware-u-s-energy-dept-confirms-breach\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2025-07-25T00:00:46+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-24T23:36:52+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/storm-2603-hits-sharepoint-servers-with-ransomware-u-s-energy-dept-confirms-breach\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/storm-2603-hits-sharepoint-servers-with-ransomware-u-s-energy-dept-confirms-breach\/\",\"name\":\"Storm-2603 hits SharePoint servers with ransomware; U.S. energy dept confirms breach - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2025-07-25T00:00:46+00:00\",\"dateModified\":\"2025-07-24T23:36:52+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/storm-2603-hits-sharepoint-servers-with-ransomware-u-s-energy-dept-confirms-breach\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/storm-2603-hits-sharepoint-servers-with-ransomware-u-s-energy-dept-confirms-breach\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/storm-2603-hits-sharepoint-servers-with-ransomware-u-s-energy-dept-confirms-breach\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Storm-2603 hits SharePoint servers with ransomware; U.S. energy dept confirms breach\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Storm-2603 hits SharePoint servers with ransomware; U.S. energy dept confirms breach - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/storm-2603-hits-sharepoint-servers-with-ransomware-u-s-energy-dept-confirms-breach\/","og_locale":"en_US","og_type":"article","og_title":"Storm-2603 hits SharePoint servers with ransomware; U.S. energy dept confirms breach - Web Hosting News","og_description":"Microsoft says the Storm-2603 threat group is using SharePoint flaws to launch Warlock ransomware attacks. The group disables Microsoft Defender, steals credentials with Mimikatz, and spreads across networks via PsExec and WMI. More than 400 organizations\u2014including the U.S. Energy Department and the NNSA\u2014have suffered breaches. Microsoft urges admins to patch vulnerable SharePoint servers now, warning [&hellip;]","og_url":"https:\/\/hostingdiscussion.com\/news\/storm-2603-hits-sharepoint-servers-with-ransomware-u-s-energy-dept-confirms-breach\/","og_site_name":"Web Hosting News","article_published_time":"2025-07-25T00:00:46+00:00","article_modified_time":"2025-07-24T23:36:52+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/storm-2603-hits-sharepoint-servers-with-ransomware-u-s-energy-dept-confirms-breach\/","url":"https:\/\/hostingdiscussion.com\/news\/storm-2603-hits-sharepoint-servers-with-ransomware-u-s-energy-dept-confirms-breach\/","name":"Storm-2603 hits SharePoint servers with ransomware; U.S. energy dept confirms breach - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2025-07-25T00:00:46+00:00","dateModified":"2025-07-24T23:36:52+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/storm-2603-hits-sharepoint-servers-with-ransomware-u-s-energy-dept-confirms-breach\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/storm-2603-hits-sharepoint-servers-with-ransomware-u-s-energy-dept-confirms-breach\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/storm-2603-hits-sharepoint-servers-with-ransomware-u-s-energy-dept-confirms-breach\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"Storm-2603 hits SharePoint servers with ransomware; U.S. energy dept confirms breach"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":193,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/7189","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=7189"}],"version-history":[{"count":1,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/7189\/revisions"}],"predecessor-version":[{"id":7191,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/7189\/revisions\/7191"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=7189"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=7189"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=7189"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}