Warlock Ransomware Exploits SharePoint at Water and Telecom Operators

What happened

Warlock is a China-linked ransomware operation that first became widely known through Microsoft SharePoint attacks in 2025. It is still using SharePoint to get into victim networks. Symantec's Threat Hunter Team published research on October 1, 2026, reporting that the group attacked at least four organizations over the previous two months. The victims were a water utility, a telecommunications provider, a regional government body and a university, all in Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America.12 Symantec tracks the actor as Longlegs. Microsoft calls it Storm-2603, and Symantec has linked the group to older activity clusters known as CL-CRI-1040, CamoFei and ChamelGang.1215

BleepingComputer, Industrial Cyber, SecurityWeek and other outlets covered the report within days.2513 Check Point included it in its October 5 threat intelligence roundup, listing the targets as utilities, telecom, government and education.3 None of the reports names the victim organizations.49

The usual way to read this story is "ransomware gang hits critical infrastructure." The more useful lesson is that a well-known exploitation path, first publicized more than a year ago, still works against organizations that run essential services. The industry's patching advice clearly did not reach all of them.

The intrusion, step by step

Symantec's most detailed case study involves one of the critical infrastructure victims. The first malicious activity was recorded on July 22, 2026, when a webshell appeared on the organization's SharePoint server.12 The attackers then ran standard reconnaissance commands such as whoami, net user /domain and nltest /domain_trusts. They also deployed DLL sideloading pairs and used the NetExec tool to map Active Directory, spray credentials and execute code remotely.7

The webshell is built to work on several SharePoint versions at once. The attackers place it in the LAYOUTS directory so it runs whichever release is installed.5 Its job is to steal the SharePoint farm's ASP.NET machine keys. With those keys, the attackers can forge validly signed payloads that execute code inside the SharePoint application pool.5 Researchers also describe the group using Visual Studio Code tunnels and the legitimate forensics tool Velociraptor for command-and-control.116

The final stage moved quickly. Security software was disabled on at least 40 hosts in about two hours. Warlock ransomware was then launched on at least 33 machines.2 Several write-ups attribute the defense-killing step to a bring-your-own-vulnerable-driver technique that abuses a K7 antivirus driver, K7RKScan.sys.616 The ransomware was distributed through the domain's SYSVOL share, along with the ransom note "how to restore your files.txt".7 SYSVOL replicates across domain controllers and every domain-joined machine can read it, so the attackers used normal Active Directory replication to spread the payload.7 One timeline puts the period from initial access to encryption at about nine days, from July 22 to July 31.15

This pattern shows the operation is not opportunistic. The attackers spent more than a week inside the network learning its structure before they disabled defenses and encrypted systems. The bulk of the damage happened in a window of about two hours, which leaves almost no time to respond for any organization without round-the-clock monitoring.

The patch-gap problem behind the ToolShell attacks

Warlock appeared in June 2025. About a month later it became widely known when attackers deploying it exploited a chain of SharePoint zero-days called ToolShell: CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771.2 Microsoft patched the first two flaws on July 8, 2025. The other two were later bypasses of those fixes.47 Only on-premises SharePoint Server 2016, 2019 and Subscription Edition are affected. SharePoint Online is not.4

The old flaws keep working because patching alone does not fix a server that was already compromised. Machine keys stolen before the update stay valid afterward. Remediation guidance therefore says to install every ToolShell fix, rotate ASP.NET machine keys, restart IIS so the new keys take effect, and check logs for unusual worker-process activity.4 Other guidance adds enabling AMSI in Full Mode, cutting SharePoint's internet exposure, and placing any public-facing deployment behind an authenticated Layer 7 proxy, with external access to Central Administration blocked.7 Symantec put it directly: ToolShell and related flaws are still a workable way in wherever SharePoint has not been patched or otherwise mitigated.5

Where the coverage diverges

The reports agree on the basic facts: four victims, four sectors, the 40-host and 33-host figures, and the regional focus. They disagree on several important details.

Old bugs or new ones? One analysis says no new 2026 CVE has been tied to the campaign and describes it as a reuse of ToolShell alone.11 Other outlets that cite Symantec say the group's toolkit may also include newer SharePoint flaws, specifically CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, CVE-2026-50522 and CVE-2026-55040.13 Another account notes that CISA warned about newer SharePoint vulnerabilities in a July 2026 advisory and that the researchers believe ToolShell is still used alongside them.157 The more cautious view, which this analysis takes, is that the group uses whatever SharePoint weakness it finds. Applying the 2025 fixes is necessary but probably not enough.

How many servers? Some articles say more than 400 SharePoint servers were compromised in the "most recent" wave.614 That number matches earlier tallies from July 2025, which counted more than 400 servers across 148 organizations during the original ToolShell outbreak.10 The 400 figure most likely belongs to 2025 and has been carried into the 2026 coverage. It should not be read as the size of this campaign. The confirmed number for the 2026 activity is at least four organizations.

Hosts versus organizations. One outlet treated the 33 compromised systems and the four victims as figures still waiting to be reconciled.11 Symantec's own reporting answers this: the 40 disabled hosts and 33 encrypted hosts both come from a single intrusion at one victim.1315

Motive and attribution. Coverage generally calls the actor "China-linked" or "China-nexus."212 However, no formal government attribution has been reported.11 Symantec's researchers said the concentration on Portuguese- and Spanish-speaking countries could mean either opportunistic targeting of exposed servers or deliberate tasking.5 Separately, Microsoft has said state-backed groups Linen Typhoon and Violet Typhoon used ToolShell exploits as well. One explainer stresses that those groups are distinct from the Warlock crew.15

Why it matters

History supports reading the targeting as deliberate. Researchers had already linked Warlock to ToolShell attacks on a Middle Eastern telecom company, government agencies in Africa and South America, and a U.S. university by October 2025.14 Early victim analysis found that nearly half of the group's first attacks hit government entities.10 The group has also been tied to the earlier compromise of SmarterTools through an unpatched SmarterMail instance. The pattern is consistent: an actor that combines extortion with possible espionage aims at exposed, self-hosted collaboration and mail servers belonging to public institutions and infrastructure operators.

The overall threat picture adds weight. Comparitech's Q3 2026 tracker counted 2,627 claimed ransomware attacks worldwide, its highest quarterly total so far, and found that fewer than one in ten victims publicly confirm an attack.4 Four confirmed Warlock victims are a small share of that total. But a water utility and a telecom carrier are the kind of targets where an incident affects the public, not only the company's balance sheet.6

The sectors involved help explain the outcome. Utilities, regional governments and universities often work with tighter budgets, slower patch cycles and smaller security teams than large private companies. They also tend to keep on-premises infrastructure longer.4 Those are the conditions in which a server patched in 2025 but never fully cleaned up can still be exploited in 2026.

What to watch

Symantec published indicators of compromise with its report, which suggests the researchers expect more victims to come to light.15 The key signals ahead are whether CISA or European agencies add newer SharePoint CVEs to exploited-vulnerability catalogs and whether new names appear on Warlock's leak site. One tracker reported no new leak-site postings in the last 30 days, though only a single source supports that.15

Organizations running SharePoint on their own servers have a clear set of tasks. They should find every SharePoint server they own, confirm that both the ToolShell fixes and the 2026 SharePoint fixes are installed, and rotate machine keys. They should also look for webshells in LAYOUTS directories and watch for loading of the K7RKScan.sys driver.69 In this case, a security fix from more than a year ago did not stop attackers from reaching critical infrastructure.