Project AK47: Uncovering a Link to the Share Point Vulnerability Attacks
Summary: Unit 42 reports high-confidence overlap between Microsoft's Storm-2603, a suspected China-based actor exploiting SharePoint via the ToolShell chain (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771), and its own tracked cluster CL-CRI-1040, active since at least March 2025. CL-CRI-1040 deploys a tool set called Project AK47, which includes AK47C2 DNS and HTTP backdoors, AK47/X2ANYLOCK ransomware, and DLL side-loading loaders, and Unit 42 ties the cluster to a former LockBit 3.0 affiliate and the Warlock Client Leaked Data Show leak site.
What's compelling: The same actor Microsoft flags as China-based espionage is, by Unit 42's evidence, also running double-extortion ransomware, so a SharePoint compromise here can end in both stolen data and encrypted files. The AK47 ransomware also terminates itself if a target's timestamp is on or after June 6, 2026, a built-in evasion check that tells you the operators plan to keep this tooling in use.