Warlock Ransomware Group Targets SharePoint in Critical Infrastructure Attacks
The Warlock ransomware group remains active in targeting SharePoint servers as part of its campaign against critical infrastructure, government, and education organizations, according to a recent Symantec report. The group is believed to be operated by a China-based hacking collective tracked as Longlegs and Storm-2603, which has previously been associated with malicious operations including CL-CRI-1040, CamoFei, and ChamelGang.
Last year, Chinese state-sponsored groups Linen Typhoon and Violet Typhoon were observed exploiting two SharePoint vulnerabilities collectively known as ToolShell as zero-days, at least two weeks before their public disclosure. Within weeks of these exploits, more than 400 SharePoint servers were compromised, with Storm-2603’s use of ToolShell standing out amid widespread advanced persistent threat (APT) activity.
Warlock Attacks Exploiting ToolShell and Other SharePoint Flaws
By October 2025, researchers identified multiple Warlock ransomware incidents that leveraged the ToolShell vulnerability for initial access. Victims of these attacks included a telecommunications firm in the Middle East, government entities in Africa and South America, and a university in the United States.
Symantec’s latest findings indicate that Storm-2603 continues to prioritize the exploitation of SharePoint vulnerabilities in its operations. In addition to ToolShell, the group’s arsenal may now include several recently disclosed flaws: CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, CVE-2026-50522, and CVE-2026-55040.
Recent Activity Shows Warlock Expanding Targets in Portuguese- and Spanish-Speaking Regions
Over the past two months, the Warlock operator has compromised at least four organizations in Portuguese- and Spanish-speaking countries. According to Symantec, the victims included two critical infrastructure operators — specifically a water utility and a telecommunications provider — along with a regional government body and a university.
In one intrusion, the attackers deployed a tool to disable security software on at least 40 systems and subsequently executed the Warlock ransomware on at least 33 of those machines. Following initial access via SharePoint exploitation, the group’s typical post-compromise behavior includes deploying webshells, exfiltrating ASP.NET machine keys, and distributing a forced signed payload to enable remote code execution (RCE).
Tactics Include DLL Sideloading, Living-Off-the-Land, and Visual Studio Code Abuse
Storm-2603 relies on DLL sideloading to execute code in memory, drops additional payloads through legitimate file-sharing and storage services, and exploits a vulnerable driver to disable security defenses. The group also makes extensive use of living-off-the-land tools for reconnaissance and command execution.
Notably, the threat actor has been observed abusing Visual Studio Code’s built-in tunnel feature by installing the code-insiders.exe binary as a service. This allows the establishment of covert remote network access that mimics legitimate traffic from developer or administrator workstations, helping to evade detection.
Warlock Payload Staged in SYSVOL for Domain-Wide Execution
To maximize impact, the group stages the Warlock payload inside the domain’s SYSVOL share. Since this directory is automatically replicated to every domain controller and is readable across the entire domain, this approach enables the ransomware to execute at scale once deployed.
Symantec concluded that Longlegs’ sustained activity — more than a year after Warlock ransomware first emerged — demonstrates that the exploitation of ToolShell and related SharePoint vulnerabilities remains a viable initial access method for attackers targeting unpatched or inadequately mitigated SharePoint deployments.
Source: SecurityWeek