A significant threat has recently emerged in the global cybersecurity landscape. According to reports from cybersecurity research institutions and media, the hacker group identified by Microsoft as "Storm-2603" (also known as Longlegs) remains active in launching "Warlock" ransomware attacks. The group primarily infiltrates systems by abusing the "ToolShell" zero-day vulnerabilities in SharePoint (including CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771).

This attack methodology has drawn widespread attention from the international cybersecurity community, particularly regarding the threat posture toward critical infrastructure, which has become a focal point for defense by governments and enterprises worldwide.

According to joint monitoring by Symantec and the Carbon Black threat hunting team, the activity trajectory of the Storm-2603 hacker group indicates a clear shift in its attack targets. While the group previously gained attention for the aforementioned SharePoint vulnerability attacks, recent investigations reveal that the hackers have not ceased their operations; instead, they have intensified their infiltration of critical infrastructure in specific linguistic regions. The affected scope covers water resource management systems, the telecommunications industry, and educational institutions. These confirmed findings indicate that the hacker group is utilizing a sophisticated exploit chain to conduct systematic attacks against core sectors of societal operation.

Although multiple cybersecurity sources have confirmed the group's attack methods and shift in targets, further public information is still needed to verify the specific geographic distribution of the group, a detailed list of victimized entities, and the specific defensive effectiveness of various governments in responding to this wave of threats. Furthermore, while Microsoft has previously flagged and identified the relevant vulnerabilities, there remain discrepancies in the details provided by various cybersecurity firms regarding the patching progress of these vulnerabilities across different industrial environments, and whether the hackers have developed new variant attack methods, necessitating further cross-referencing of threat intelligence.

Such ransomware attacks targeting critical infrastructure pose a direct threat to public safety and industrial stability in North America and globally. The water and telecommunications industries are lifelines of a nation; once encrypted or paralyzed by ransomware, they severely impact public livelihood and social order. Additionally, as hubs for research and data storage, educational institutions, if targeted, risk the leakage of academic resources or the disruption of administrative systems. This wave of attacks demonstrates that hackers are leveraging corporate reliance on digital transformation and cloud collaboration software (such as SharePoint) to expand the impact of ransomware attacks from simple commercial extortion to the level of national infrastructure security.

However, experts caution that one should not overreact to ransomware threats, nor should all attack incidents be attributed to a single hacker group. While the threat from Storm-2603 is real, enterprises and government agencies should return to fundamental cybersecurity defense architectures when facing ransomware, including regular system patching, the implementation of Identity and Access Management (IAM), and the establishment of robust offline backup mechanisms. Over-interpreting the scale of a single hacker group's threat may lead to an imbalance in the allocation of defensive resources, causing organizations to overlook other potential supply chain attacks or social engineering risks.

Subsequent observation will focus on whether the group further expands its attack scope and whether the global cybersecurity defense system's patching rate for the "ToolShell" vulnerability improves. Furthermore, the progress of cooperation between international law enforcement agencies and private sector cybersecurity teams, as well as whether cybersecurity resilience regulations for critical infrastructure will be adjusted in response to this wave of threats, will be key indicators for assessing global cybersecurity risks in the coming months.