A Chinese-based threat actor has been observed using the flaws in Microsoft SharePoint to deploy ransomware on compromised systems. In an incident update on July 23, Microsoft revealed that a group tracked as Storm-2603 is distributing Warlock ransomware on exploited SharePoint on-prem servers. As a result, the tech giant has advised potentially affected organizations to expand their mitigation efforts to include protection against ransomware. Storm-2603 is one of three groups observed to be exploiting on-prem SharePoint vulnerabilities, CVE-2025-53770 and CVE-2025-53771. It has been assessed with moderate confidence that Storm-2603 is a China-based threat actor. The group has been known to deploy Warlock and LockBit ransomware. Microsoft said it is currently unable to confidently assess…