Warlock Ransomware Targets Water and Telecom Operators Through SharePoint

Ransomware operators behind Warlock are continuing to exploit vulnerabilities in on-premises Microsoft SharePoint Server, with recent activity affecting critical infrastructure, government and education organizations.

According to a new report from Security.com and the Symantec Threat Hunter Team, the China-nexus threat actor tracked as Longlegs, also known as Storm-2603, attacked at least four organizations during the two months preceding the report.

The victims included a water utility, a telecommunications provider, a regional government organization and a university. The affected organizations were located in Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America.

The activity is notable because the group continues to use Microsoft SharePoint as an entry point more than a year after Warlock first emerged.

Warlock and the Longlegs connection

Warlock ransomware first emerged in June 2025. It gained wider attention weeks later when attackers deploying the ransomware were observed exploiting a series of Microsoft SharePoint zero-day vulnerabilities known collectively as ToolShell.

The vulnerabilities identified in the original activity included:

• CVE-2025-49704

• CVE-2025-49706

• CVE-2025-53770

• CVE-2025-53771

Security.com reports that these vulnerabilities may still form part of the group's toolkit, alongside newer SharePoint vulnerabilities. CISA also issued an advisory concerning newer SharePoint flaws in July 2026.

Symantec tracks the group responsible for the activity as Longlegs, also known as Storm-2603. The report also connects Longlegs with older activity clusters identified as CL-CRI-1040, CamoFei and ChamelGang.

The recent targeting pattern is particularly significant because two of the identified victims operate critical infrastructure.

Recent targeting includes critical infrastructure

The latest activity involved at least four organizations:

The victims were located across Europe, Africa and Latin America, with a concentration in Portuguese- and Spanish-speaking countries. Security.com notes that previous Warlock activity had been observed against organizations in countries including the United States, Brazil, India, Russia, Taiwan and Japan.

The report does not establish whether the recent geographic concentration represents deliberate targeting or an opportunistic pattern based on vulnerable internet-facing SharePoint deployments.

SharePoint remains the initial access route

The latest investigation indicates that Longlegs continues to favor vulnerabilities in on-premises Microsoft SharePoint Server for initial access.

After compromising a SharePoint server, the attackers can place a webshell inside the SharePoint LAYOUTS directory. The report says the webshell was designed to work across multiple SharePoint versions.

The attackers then harvested the SharePoint farm's ASP.NET machine keys. These keys were used to forge a validly signed payload capable of achieving remote code execution within the SharePoint application pool.

This technique demonstrates why patching exposed SharePoint infrastructure remains important. A vulnerable public-facing application can provide an attacker with an initial foothold before the ransomware itself appears.

DLL sideloading and vulnerable drivers

Once inside the environment, Longlegs used several techniques to avoid detection and maintain access.

One of these was DLL sideloading, where malicious code is loaded through legitimate executable components. The attackers also downloaded additional payloads from public cloud storage and file-sharing services, including catbox[.]moe and wasabisys[.]com.

The report also describes the use of a vulnerable signed driver called K7RKScan. The driver is associated with CVE-2025-1055 and can be abused to terminate protected security processes.

This represents a bring-your-own-vulnerable-driver, or BYOVD, technique. Rather than attempting to directly defeat every security control, an attacker can abuse a legitimate but vulnerable signed driver to interfere with security software at a lower system level.

In the investigated intrusion, the exact identity of the driver used by the observed AV/EDR-killing tool was not confirmed. Security.com notes that Longlegs had used K7RKScan in other recent attacks.

Living-off-the-land tools and Visual Studio Code tunnels

Longlegs also relied heavily on legitimate system and administrative tools.

The investigation observed commands associated with reconnaissance and domain discovery, including:

• net user /domain

• whoami

• nltest /domain_trusts

• NetExec

These tools are not inherently malicious. Their legitimate administrative functions can make malicious activity harder to distinguish from normal activity.

The attackers also abused the tunneling capability built into Visual Studio Code Insiders. The report says they installed the code-insiders.exe binary as a service and used the tunnel functionality for remote access.

Because the binary is Microsoft-signed and the tunnel uses Microsoft's infrastructure, this activity could blend with traffic normally associated with developer or administrator workstations.

For defenders, this illustrates a broader challenge: security monitoring cannot focus only on obviously malicious software. Legitimate administrative tools can become part of an intrusion chain.

The critical infrastructure intrusion

The report provides a detailed timeline of one intrusion against a critical infrastructure organization.

The first observed malicious activity occurred on July 22, 2026, when a webshell was installed on a SharePoint server.

Two days later, the attackers conducted reconnaissance against another SharePoint host. They subsequently deployed executables and DLLs associated with DLL sideloading and performed Active Directory trust discovery.

On July 28, the exploitation chain became more active. The attackers executed a sequence involving a forged machine-key-signed __VIEWSTATE payload, enabling code execution within the SharePoint application pool.

Follow-on packages were then downloaded from public hosting services.

The attackers subsequently expanded beyond the initial SharePoint systems. A domain account named SPSEPRDSetup was repeatedly added to local Administrators groups on additional hosts. The report describes the account name as likely masquerading as a legitimate SharePoint service account.

From initial access to domain-wide movement

The intrusion then progressed from individual SharePoint systems toward the wider Windows domain.

NetExec was used for Active Directory enumeration, credential spraying and remote command execution. At the same time, the attackers established another remote-access mechanism using the Visual Studio Code tunnel functionality.

This combination allowed the attackers to move beyond their initial entry point and interact with additional systems inside the organization.

The attack therefore followed a broader sequence:

Initial access → Execution → Reconnaissance → Privilege expansion → Remote access → Defense evasion → Ransomware deployment

The ransomware was not the first stage of the intrusion. It appeared after the attackers had already established access and expanded their control.

SYSVOL became the ransomware distribution mechanism

One of the most significant elements of the intrusion was the use of SYSVOL to distribute the Warlock ransomware.

SYSVOL is a domain-wide Windows location that is automatically replicated between domain controllers. The attackers staged ransomware payloads there and used the normal replication mechanism to make them available across the environment.

The report states that two ransomware binaries, run.exe and rune.exe, together with a ransom note named "how to restore your files.txt", were recorded on at least 33 hosts.

Before this happened, the attackers deployed an AV/EDR-killing tool.

The security-disabling tool was observed on at least 40 additional hosts within approximately two hours. This indicates that the attackers were attempting to disable protection across a large portion of the environment before launching the ransomware.

The Warlock payload then appeared on hosts shortly after security protection had been disabled.

Security.com also reports that activity on three additional hosts showed dfsrs.exe, the Windows service responsible for SYSVOL replication, as the parent process delivering the ransomware binaries.

This provided direct evidence that the payload had reached those systems through ordinary SYSVOL replication rather than requiring a separate manual transfer to each host.

Why the activity matters

The latest activity demonstrates that SharePoint exploitation remains a practical route into organizations where vulnerable deployments have not been patched or otherwise mitigated.

The attack also illustrates how ransomware operations can combine several techniques rather than relying on a single malware payload.

The observed chain included:

• Exploitation of public-facing SharePoint infrastructure

• Webshell deployment

• ASP.NET machine-key abuse

• Remote code execution

• DLL sideloading

• Public cloud-hosted payload delivery

• Active Directory reconnaissance

• Credential spraying

• Legitimate administrative tooling

• Visual Studio Code tunneling

• Vulnerable-driver abuse

• Security software disruption

• SYSVOL-based ransomware distribution

For defenders, the important point is that the ransomware executable represents only one part of the overall intrusion.

What organizations can take from the investigation

The investigation highlights several areas that security teams should review.

1. Patch exposed SharePoint systems

Organizations operating on-premises SharePoint should verify that relevant security updates and mitigations have been applied. Internet-facing SharePoint systems deserve particular attention because they can provide an external entry point.

2. Monitor unusual administrative activity

Commands such as net, whoami, nltest and other administrative utilities have legitimate uses. However, unexpected combinations of these commands across servers can provide useful signals during an intrusion.

3. Watch for vulnerable-driver abuse

Security teams should monitor for the introduction or execution of vulnerable signed drivers, particularly when they appear shortly before security software stops functioning.

4. Review SYSVOL activity

Unexpected executable files appearing within SYSVOL or unusual changes to scripts and Group Policy-related locations should receive investigation.

5. Monitor remote-access features

Legitimate developer and administrative tools can be abused for persistence or remote access. Visual Studio Code tunneling activity should therefore be evaluated according to the organization's expected usage.

6. Investigate security-control disruption quickly

The report shows that ransomware deployment followed closely after security protection was disabled. An unexplained AV or EDR failure across multiple systems can therefore represent a high-priority investigation signal.

Indicators of compromise

Security.com published file and network indicators associated with the activity.

The report includes multiple SHA-256 file hashes classified as Warlock, malicious DLLs, suspicious files, an AV/EDR killer and a vulnerable driver. It also identifies network indicators including:

• litter[.]catbox[.]moe

• xn8xyt-drop[.]s3[.]wasabisys[.]com

Security teams should consult the original report for the complete IOC list and assess indicators against their own telemetry and threat-intelligence processes.

Broader security context

The Warlock campaign highlights a broader industry shift toward ransomware operations that combine vulnerability exploitation, legitimate administrative tooling and defense evasion before the final ransomware stage.

For enterprises, this could mean that ransomware readiness increasingly depends on detecting the attack chain, rather than waiting for encryption or ransom activity to provide the first obvious signal.

The investigation also shows why critical infrastructure organizations need layered monitoring around internet-facing applications, identity systems, administrative tools and domain-wide file replication mechanisms.

The recent targeting does not establish that all organizations in Portuguese- or Spanish-speaking countries are specifically targeted. Security.com notes that the concentration could reflect either opportunistic exploitation of exposed SharePoint systems or more deliberate tasking.

What is clear from the investigation is that Longlegs continues to use SharePoint vulnerabilities as an initial access route and can progress from a compromised application server to broad domain-level ransomware deployment.