Threat actor

Storm-2603

In 6 briefs, most recently 5 November 2026. RSS for this tag

Learn more: Malpedia ↗ ThreatFox ↗ MalwareBazaar ↗

Coverage in DanSec Daily

  1. Zyxel GS1900 zero-day hit nearly 1,000 switches, OpenSSH 'sshole' flaw on musl systems, and Chainalysis confirms all users' tokens exposed.
  2. SonicWall SSL VPN compromises across 100+ environments, Oracle EBS zero-day malware attacks, and FBI seizure of BreachForums domains tied to ShinyHunters.
  3. FBI seizes BreachForums amid ShinyHunters Salesforce extortion; Gladinet CentreStack zero-day CVE-2025-11371 and Oracle EBS zero-day attacks actively exploited.
  4. Akira ransomware exploiting SonicWall SSL VPN zero-days, the Pi-hole GiveWP breach, and Secret Blizzard AitM attacks on Moscow embassies.
  5. BlackSuit ransomware sites seized, Toptal GitHub breach poisons npm packages, and ToolShell SharePoint flaws hit 400+ servers.
  6. SharePoint zero-days under active exploitation by Chinese APTs, Cisco ISE RCE flaws, and Dell's breach by World Leaks group.