--- url: "https://www.xcademia.com/news/warlock-ransomware-targets-water-and-telecom-operators-through-sharepoint" title: Warlock Ransomware Targets Water and Telecom Operators Through SharePoint description: "Warlock ransomware attackers exploit SharePoint to target water, telecom, government and education organizations through a China-nexus campaign." publishedAt: "2026-10-03T10:49:14.625+00:00" updatedAt: "2026-10-07T12:02:19.399656+00:00" type: news category: cybersecurity source_name: Security.com source_url: "https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure" tags: - "#WarlockRansomware" - "#MicrosoftSharePoint" - "#CyberSecurity" - "#CriticalInfrastructure" - "#ThreatIntelligence" - "#SharePointSecurity" - "#Longlegs" - "#Ransomware" --- # Warlock Ransomware Targets Water and Telecom Operators Through SharePoint > Warlock ransomware attackers linked to the China-nexus Longlegs group are continuing to exploit Microsoft SharePoint vulnerabilities, targeting critical infrastructure, government and education organizations across Portuguese- and Spanish-speaking regions. Source: **Security.com** · 3 October 2026 Ransomware operators behind **Warlock** are continuing to exploit vulnerabilities in on-premises Microsoft SharePoint Server, with recent activity affecting critical infrastructure, government and education organizations. According to a new report from [Security.com](http://Security.com) and the Symantec Threat Hunter Team, the China-nexus threat actor tracked as **Longlegs**, also known as **Storm-2603**, attacked at least four organizations during the two months preceding the report. The victims included a water utility, a telecommunications provider, a regional government organization and a university. The affected organizations were located in Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America. The activity is notable because the group continues to use Microsoft SharePoint as an entry point more than a year after Warlock first emerged. ## Warlock and the Longlegs connection Warlock ransomware first emerged in June 2025. It gained wider attention weeks later when attackers deploying the ransomware were observed exploiting a series of Microsoft SharePoint zero-day vulnerabilities known collectively as **ToolShell**. The vulnerabilities identified in the original activity included: - CVE-2025-49704 - CVE-2025-49706 - CVE-2025-53770 - CVE-2025-53771 [Security.com](http://Security.com) reports that these vulnerabilities may still form part of the group's toolkit, alongside newer SharePoint vulnerabilities. CISA also issued an advisory concerning newer SharePoint flaws in July 2026. Symantec tracks the group responsible for the activity as Longlegs, also known as Storm-2603. The report also connects Longlegs with older activity clusters identified as CL-CRI-1040, CamoFei and ChamelGang. The recent targeting pattern is particularly significant because two of the identified victims operate critical infrastructure. ## Recent targeting includes critical infrastructure The latest activity involved at least four organizations: Target type Reported victim Critical infrastructure Water utility Critical infrastructure Telecommunications provider Government Regional government organization Education University The victims were located across Europe, Africa and Latin America, with a concentration in Portuguese- and Spanish-speaking countries. [Security.com](http://Security.com) notes that previous Warlock activity had been observed against organizations in countries including the United States, Brazil, India, Russia, Taiwan and Japan. The report does not establish whether the recent geographic concentration represents deliberate targeting or an opportunistic pattern based on vulnerable internet-facing SharePoint deployments. ![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1791024401170-info1--105-.webp) ## SharePoint remains the initial access route The latest investigation indicates that Longlegs continues to favor vulnerabilities in **on-premises Microsoft SharePoint Server** for initial access. After compromising a SharePoint server, the attackers can place a webshell inside the SharePoint LAYOUTS directory. The report says the webshell was designed to work across multiple SharePoint versions. The attackers then harvested the SharePoint farm's [ASP.NET](http://ASP.NET) machine keys. These keys were used to forge a validly signed payload capable of achieving remote code execution within the SharePoint application pool. This technique demonstrates why patching exposed SharePoint infrastructure remains important. A vulnerable public-facing application can provide an attacker with an initial foothold before the ransomware itself appears. ## DLL sideloading and vulnerable drivers Once inside the environment, Longlegs used several techniques to avoid detection and maintain access. One of these was **DLL sideloading**, where malicious code is loaded through legitimate executable components. The attackers also downloaded additional payloads from public cloud storage and file-sharing services, including catbox[.]moe and wasabisys[.]com. The report also describes the use of a vulnerable signed driver called **K7RKScan**. The driver is associated with CVE-2025-1055 and can be abused to terminate protected security processes. This represents a **bring-your-own-vulnerable-driver**, or BYOVD, technique. Rather than attempting to directly defeat every security control, an attacker can abuse a legitimate but vulnerable signed driver to interfere with security software at a lower system level. In the investigated intrusion, the exact identity of the driver used by the observed AV/EDR-killing tool was not confirmed. [Security.com](http://Security.com) notes that Longlegs had used K7RKScan in other recent attacks. ## Living-off-the-land tools and Visual Studio Code tunnels Longlegs also relied heavily on legitimate system and administrative tools. The investigation observed commands associated with reconnaissance and domain discovery, including: - `net user /domain` - `whoami` - `nltest /domain_trusts` - NetExec These tools are not inherently malicious. Their legitimate administrative functions can make malicious activity harder to distinguish from normal activity. The attackers also abused the tunneling capability built into **Visual Studio Code Insiders**. The report says they installed the `code-insiders.exe` binary as a service and used the tunnel functionality for remote access. Because the binary is Microsoft-signed and the tunnel uses Microsoft's infrastructure, this activity could blend with traffic normally associated with developer or administrator workstations. For defenders, this illustrates a broader challenge: security monitoring cannot focus only on obviously malicious software. Legitimate administrative tools can become part of an intrusion chain. ![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1791024426518-info2--106-.webp) ## The critical infrastructure intrusion The report provides a detailed timeline of one intrusion against a critical infrastructure organization. The first observed malicious activity occurred on **July 22, 2026**, when a webshell was installed on a SharePoint server. Two days later, the attackers conducted reconnaissance against another SharePoint host. They subsequently deployed executables and DLLs associated with DLL sideloading and performed Active Directory trust discovery. On July 28, the exploitation chain became more active. The attackers executed a sequence involving a forged machine-key-signed `__VIEWSTATE` payload, enabling code execution within the SharePoint application pool. Follow-on packages were then downloaded from public hosting services. The attackers subsequently expanded beyond the initial SharePoint systems. A domain account named **SPSEPRDSetup** was repeatedly added to local Administrators groups on additional hosts. The report describes the account name as likely masquerading as a legitimate SharePoint service account. ## From initial access to domain-wide movement The intrusion then progressed from individual SharePoint systems toward the wider Windows domain. NetExec was used for Active Directory enumeration, credential spraying and remote command execution. At the same time, the attackers established another remote-access mechanism using the Visual Studio Code tunnel functionality. This combination allowed the attackers to move beyond their initial entry point and interact with additional systems inside the organization. The attack therefore followed a broader sequence: **Initial access → Execution → Reconnaissance → Privilege expansion → Remote access → Defense evasion → Ransomware deployment** The ransomware was not the first stage of the intrusion. It appeared after the attackers had already established access and expanded their control. ## SYSVOL became the ransomware distribution mechanism One of the most significant elements of the intrusion was the use of **SYSVOL** to distribute the Warlock ransomware. SYSVOL is a domain-wide Windows location that is automatically replicated between domain controllers. The attackers staged ransomware payloads there and used the normal replication mechanism to make them available across the environment. The report states that two ransomware binaries, `run.exe` and `rune.exe`, together with a ransom note named **"how to restore your files.txt"**, were recorded on at least 33 hosts. Before this happened, the attackers deployed an AV/EDR-killing tool. The security-disabling tool was observed on at least **40 additional hosts within approximately two hours**. This indicates that the attackers were attempting to disable protection across a large portion of the environment before launching the ransomware. The Warlock payload then appeared on hosts shortly after security protection had been disabled. [Security.com](http://Security.com) also reports that activity on three additional hosts showed `dfsrs.exe`, the Windows service responsible for SYSVOL replication, as the parent process delivering the ransomware binaries. This provided direct evidence that the payload had reached those systems through ordinary SYSVOL replication rather than requiring a separate manual transfer to each host. ![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1791024476885-info3--105-.webp) ## Why the activity matters The latest activity demonstrates that SharePoint exploitation remains a practical route into organizations where vulnerable deployments have not been patched or otherwise mitigated. The attack also illustrates how ransomware operations can combine several techniques rather than relying on a single malware payload. The observed chain included: - Exploitation of public-facing SharePoint infrastructure - Webshell deployment - [ASP.NET](http://ASP.NET) machine-key abuse - Remote code execution - DLL sideloading - Public cloud-hosted payload delivery - Active Directory reconnaissance - Credential spraying - Legitimate administrative tooling - Visual Studio Code tunneling - Vulnerable-driver abuse - Security software disruption - SYSVOL-based ransomware distribution For defenders, the important point is that the ransomware executable represents only one part of the overall intrusion. ## What organizations can take from the investigation The investigation highlights several areas that security teams should review. **1. Patch exposed SharePoint systems** Organizations operating on-premises SharePoint should verify that relevant security updates and mitigations have been applied. Internet-facing SharePoint systems deserve particular attention because they can provide an external entry point. **2. Monitor unusual administrative activity** Commands such as `net`, `whoami`, `nltest` and other administrative utilities have legitimate uses. However, unexpected combinations of these commands across servers can provide useful signals during an intrusion. **3. Watch for vulnerable-driver abuse** Security teams should monitor for the introduction or execution of vulnerable signed drivers, particularly when they appear shortly before security software stops functioning. **4. Review SYSVOL activity** Unexpected executable files appearing within SYSVOL or unusual changes to scripts and Group Policy-related locations should receive investigation. **5. Monitor remote-access features** Legitimate developer and administrative tools can be abused for persistence or remote access. Visual Studio Code tunneling activity should therefore be evaluated according to the organization's expected usage. **6. Investigate security-control disruption quickly** The report shows that ransomware deployment followed closely after security protection was disabled. An unexplained AV or EDR failure across multiple systems can therefore represent a high-priority investigation signal. ## Indicators of compromise [Security.com](http://Security.com) published file and network indicators associated with the activity. The report includes multiple SHA-256 file hashes classified as Warlock, malicious DLLs, suspicious files, an AV/EDR killer and a vulnerable driver. It also identifies network indicators including: - `litter[.]catbox[.]moe` - `xn8xyt-drop[.]s3[.]wasabisys[.]com` Security teams should consult the original report for the complete IOC list and assess indicators against their own telemetry and threat-intelligence processes. ## Broader security context The Warlock campaign highlights a broader industry shift toward ransomware operations that combine vulnerability exploitation, legitimate administrative tooling and defense evasion before the final ransomware stage. For enterprises, this could mean that ransomware readiness increasingly depends on detecting the **attack chain**, rather than waiting for encryption or ransom activity to provide the first obvious signal. The investigation also shows why critical infrastructure organizations need layered monitoring around internet-facing applications, identity systems, administrative tools and domain-wide file replication mechanisms. The recent targeting does not establish that all organizations in Portuguese- or Spanish-speaking countries are specifically targeted. [Security.com](http://Security.com) notes that the concentration could reflect either opportunistic exploitation of exposed SharePoint systems or more deliberate tasking. What is clear from the investigation is that Longlegs continues to use SharePoint vulnerabilities as an initial access route and can progress from a compromised application server to broad domain-level ransomware deployment. ## Original source https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure ## Tags `#WarlockRansomware` · `#MicrosoftSharePoint` · `#CyberSecurity` · `#CriticalInfrastructure` · `#ThreatIntelligence` · `#SharePointSecurity` · `#Longlegs` · `#Ransomware` --- ## About this content This Markdown news article is the citation-grade twin of [Warlock Ransomware Targets Water and Telecom Operators Through SharePoint](https://www.xcademia.com/news/warlock-ransomware-targets-water-and-telecom-operators-through-sharepoint). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://www.xcademia.com/news/warlock-ransomware-targets-water-and-telecom-operators-through-sharepoint - Publisher: Xcademia, https://www.xcademia.com - Catalogue index: https://www.xcademia.com/llms-full.txt