The Roundup

Security news from around the web with our take: what happened, what it means for you, and what defenders should do. We link every original story.

1 story matches your filters.

MediumCVE-2025-53770CVE-2025-53771+1 CVEs 4 Hunt LeadsIOCs Remote Attacker Storm-2603 Warlock Kaspersky Securelist

Storm-2603 Hid a SharePoint Webshell in Memory, Then Reached for Warlock

Kaspersky details a December ToolShell intrusion it ties to Storm-2603: a webshell living only inside w3wp.exe, Velociraptor and four tunnels for backup access, a BYOVD EDR killer and a blocked Warlock ransomware launch.

Nov 5, 2026