Microsoft’s Detection and Response Team (DART) recently uncovered a complex, multi-stage cyberattack in which two distinct threat actors simultaneously compromised a single environment.
This unusual overlapping activity allowed both attackers to sustain deep access while inadvertently masking each other’s operations, making detection and attribution highly difficult.
The investigation revealed a blend of familiar ransomware tactics alongside quieter, deliberate techniques aimed at long-term network control.
By collaborating with Microsoft Threat Intelligence, incident responders connected isolated data points to form a complete picture of the attack.
They discovered that the initial entry points and subsequent lateral movements were the work of entirely separate groups.
This incident highlights how modern cyberattacks are evolving beyond single-actor breaches, requiring defenders to correlate telemetry across their entire network to uncover the full scope of an intrusion.
Microsoft Spots Dual Intrusion
The primary attacker, identified as Storm-2603, has been targeting on-premises SharePoint servers since mid-2025.
The group initially probed the network for local file inclusion vulnerabilities, hunting for sensitive configuration files such as web.config and win.ini to establish a foothold.
While the exact initial-access exploit remains unconfirmed, the timing strongly suggests reconnaissance aimed at identifying vulnerable entry points.
Once inside the network, Storm-2603 shifted its focus to maintaining persistence and control by blending in with legitimate administrative tasks.
The attackers deployed Velociraptor a trusted forensic and incident response tool—with SYSTEM-level privileges to map the victim’s environment.
They then established multiple remote access channels using Cloudflare tunneling, Zoho Assist, and Secure Shell (SSH) connections configured through Visual Studio Code.
To escalate privileges, Storm-2603 created new local and domain administrator accounts. They also employed defense evasion techniques, such as exploiting a vulnerable driver to tamper with system memory and turn off security protections.
While tracking this activity, investigators found indicators of a second, unrelated threat actor operating in the background. This secondary attacker utilized malicious dynamic link library (DLL) sideloading and custom backdoors.
DLL sideloading allows attackers to hide payloads behind trusted software, evading detection while maintaining persistence.
These overlapping streams of malicious activity created a chaotic environment where one attacker’s noise effectively camouflaged the other.
Upon discovery, DART rapidly activated a structured response playbook to contain the active intrusion and stabilize the compromised network.
Responders correlated telemetry across cloud resources, endpoints, and identities to establish a unified view of the attack.
This comprehensive visibility enabled the team to track evolving threat actor activity, uncover credential misuse, and execute timely containment actions through daily coordination with the affected organization.
According to Microsoft research, organizations must close common security gaps related to network exposure, visibility, and identity management.
Rigorous patching and vulnerability management for internet-facing systems are essential first steps to block initial access attempts.
Additionally, strengthening identity security controls will limit an attacker’s ability to escalate privileges if they do breach the perimeter. Isolated security alerts rarely tell the whole story during a sophisticated breach.
Organizations that invest in connected telemetry and operational preparedness are much better positioned to detect credential abuse early, contain active intrusions, and minimize the overall impact of parallel attacks.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 recently uncovered a complex, multi-stage cyberattack in which two distinct threat actors){kind=link}