INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

China-linked ransomware attacks breach Secure Point in Seoul infrastructure

| 2026-10-04 11:53 CRITICAL HIGH RANSOMWARE & EXTORTION STATE-SPONSORED & ESPIONAGE
JSON
Executive Summary
AI-generated
A Chinese-linked attack group, identified as 'Longlegs' or 'Storm-2603', has been targeting at least four institutions in countries that use Portuguese and Spanish languages, primarily in Europe and Africa, and South America over the past two months. The attackers exploited a vulnerability in Microsoft SharePoint servers to breach critical infrastructure, including water and telecommunications companies, local government agencies, and universities. They used the tunneling feature of Visual Studio Code development tool to create a hidden backdoor that allowed them to access internal systems from outside, and installed ransomware on at least 33 systems, specifically targeting system volume (SYSVOL) in Windows domain environments. The attackers deployed 'Warlock' ransomware on a large scale after disabling security products, including antivirus, endpoint detection and response systems, and executing a disable tool on at least 40 systems for 2 hours.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2025-3248 and treat internet-facing systems that were not patched in time as potentially compromised until verified.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2025-3248CVE-2025-3248
Target & Sectors
LATAM LATAM EUROPE EUROPE AFRICA AFRICA educationeducation governmentgovernment telecommunicationstelecommunications
Incident Timeline
‎early June 2026
Threat actors used an unspecified ransomware strain to breach Secure Point's systems in early June 2026, targeting key infrastructure and telecommunications in Seoul.
general_metric 18 hours
The attack took place in early June 2026 over a period of about 18 hours.
‎2026/10/04
China-linked ransomware attacks breached Secure Point, targeting key infrastructure in Seoul and telecommunications.
organisation Secure Point
China-linked ransomware attacks breached Secure Point, targeting key infrastructure in Seoul and telecommunications..
organisation Microsoft SharePoint
A Chinese-linked attack group has exploited a vulnerability in Microsoft SharePoint servers to breach critical infrastructure, including water and telecommunications companies, and deployed the 'Warlock' ransomware on a large scale, according to a confirmed incident.
organisation Storm-2603
According to the Samtanek threat hunting team, the attackers, identified as 'Longlegs' or 'Storm-2603', have been targeting at least four institutions, including water and telecommunications companies, local government agencies, and universities, over the past two months.
infrastructure Windows
The attackers specifically installed ransomware on the system volume (SYSVOL) in the Windows domain environment, where policies and files are shared.
infrastructure Visual Studio Code
Once inside the network, the attackers used the tunneling feature of the Visual Studio Code development tool to create a hidden backdoor that allowed them to access the internal system from outside.
organisation the Visual Studio Code
Once inside the network, the attackers used the tunneling feature of the Visual Studio Code development tool to create a hidden backdoor that allowed them to access the internal system from outside.
organisation SharePoint
The attackers exploited the SharePoint vulnerability to install a web shell and extract the server's encryption key, then created fake malicious data that appeared to be signed by the normal request, allowing them to execute code remotely.
infrastructure Macos
ENCFORGE is specifically built for the artificial intelligence (AI) infrastructure, scanning for nearly 180 file extensions spanning model checkpoints, vector databases, training datasets, and embedding indices, along with macOS-centric files like Keychain stores, Xcode project files, and Apple Pages and Numbers documents.
data_breach 180 file extensions
ENCFORGE is specifically built for the artificial intelligence (AI) infrastructure, scanning for nearly 180 file extensions spanning model checkpoints, vector databases, training datasets, and embedding indices, along with macOS-centric files like Keychain stores, Xcode project files, and Apple Pages and Numbers documents.
organisation Delete Azure Resources
JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources.
organisation JADEPUFFER
The threat actor known as JADEPUFFER has been observed orchestrating destructive actions within a Microsoft Azure environment using compromised service principals.
organisation Microsoft Azure
The threat actor known as JADEPUFFER has been observed orchestrating destructive actions within a Microsoft Azure environment using compromised service principals.
organisation Microsoft
Microsoft, which is tracking the activity under the name Storm-3168 , has called it an evolution of the threat actor's tradecraft.
organisation SQL
"The destructive operations were facilitated by compromising service principals and targeted Azure Storage Accounts, SQL databases, Key Vaults, Function Apps, recovery protection locks, Virtual Machines, and App Services," researchers Yossi Weizman and Tushar Mudi, along with the Microsoft Security Research team, said .
organisation Virtual Machines
"The destructive operations were facilitated by compromising service principals and targeted Azure Storage Accounts, SQL databases, Key Vaults, Function Apps, recovery protection locks, Virtual Machines, and App Services," researchers Yossi Weizman and Tushar Mudi, along with the Microsoft Security Research team, said .
organisation App Services
"The destructive operations were facilitated by compromising service principals and targeted Azure Storage Accounts, SQL databases, Key Vaults, Function Apps, recovery protection locks, Virtual Machines, and App Services," researchers Yossi Weizman and Tushar Mudi, along with the Microsoft Security Research team, said .
organisation the Microsoft Security Research
"The destructive operations were facilitated by compromising service principals and targeted Azure Storage Accounts, SQL databases, Key Vaults, Function Apps, recovery protection locks, Virtual Machines, and App Services," researchers Yossi Weizman and Tushar Mudi, along with the Microsoft Security Research team, said .
organisation Azure Virtual Machines
The enumeration activity targeted Azure Virtual Machines, subscriptions, resource groups, and resources for close to 16 hours, carrying out over 300 read operations during the time period.
organisation API
However, each of the database deletion attempts ended up in failure due to the use of an unsupported API version for the Azure SQL database resource type.
organisation Storm-3168
Microsoft said it has also detected repeated probing from Storm-3168 linked infrastructure against several Azure App services for different customers, adding that the attacks are likely automated or scripted given the division of work using multiple service principals and the timing between the different operations.
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
The attackers specifically installed ransomware on the system volume (SYSVOL) in the Windows domain environment, where policies and files are shared.
Metrics
infrastructure
‎Visual Studio Code
Affected Product
Once inside the network, the attackers used the tunneling feature of the Visual Studio Code development tool to create a hidden backdoor that allowed them to access the internal system from outside.
Metrics
infrastructure
‎Macos
Affected Product
ENCFORGE is specifically built for the artificial intelligence (AI) infrastructure, scanning for nearly 180 file extensions spanning model checkpoints, vector databases, training datasets, and embedding indices, along with macOS-centric files like Keychain stores, Xcode project files, and Apple Pages and Numbers documents.
Metrics
data_breach
180
File Extensions
ENCFORGE is specifically built for the artificial intelligence (AI) infrastructure, scanning for nearly 180 file extensions spanning model checkpoints, vector databases, training datasets, and embedding indices, along with macOS-centric files like Keychain stores, Xcode project files, and Apple Pages and Numbers documents.
Intelligence Sources
The Hacker News 2026-09-28
Dailysecu 2026-10-04