The Warlock ransomware group continues to target SharePoint servers in attacks on critical infrastructure, government and educational institutions, Symantec reports.
Warlock is believed to be operated by a China-based hacking group called Longlegs and Storm-2603, which has been linked to malicious operations such as CL-CRI-1040, CamoFei and ChamelGang.
Last year, Chinese state-sponsored groups Linen Typhoon and Violet Typhoon were observed exploiting two SharePoint vulnerabilities called ToolShell as zero-days at least two weeks before publication.
In just a few weeks, more than 400 SharePoint servers were compromised, and Storm-2603’s ToolShell exploitation stood out amid heavy APT activity.
By October 2025, researchers discovered numerous Warlock ransomware attacks that exploited ToolShell. The group’s victims included a Middle Eastern telecommunications company, African and South American government entities, and a U.S. university.
According to a fresh one Symantec reportStorm-2603 continues to advocate exploiting SharePoint bugs in attacks. In addition to ToolShell, its arsenal may also include recent vulnerabilities such as CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, CVE-2026-50522 and CVE-2026-55040.
In the last two months, the Warlock operator has attacked at least four victim organizations in Portuguese and Spanish-speaking countries.
“Victims included two critical infrastructure operators, a water utility and a telecommunications provider, as well as a regional government agency and a university,” Symantec reports.
As part of one breach, the hacking group used a tool to disable security software on at least 40 systems and then ran Warlock on at least 33 of them.
The group’s exploitation of SharePoint vulnerabilities is typically followed by a webshell deployment, exfiltration of ASP.NET machine keys, and deployment of a forced signed remote code execution (RCE) payload.
Storm-2603 relies on DLL sideloading for in-memory code execution, drops additional payloads from legitimate file sharing and storage services and a vulnerable driver to disable security tools, and relies on live off-the-land tools for reconnaissance and command execution.
“The group was also observed abusing Visual Studio Code’s built-in tunneling feature and installing the code-insiders.exe binary as a service to establish covert remote network access, interfering with traffic typically originating from developer or administrator workstations,” notes Symantec.
Additionally, the threat actor deploys the Warlock payload in the domain’s SYSVOL share, which is automatically replicated on each domain controller and is domain-readable to execute the file-encrypting ransomware at scale.
“Longlegs’ continued activity, more than a year after Warlock ransomware was first reported, shows that exploiting ToolShell and other related SharePoint vulnerabilities remains a viable first route for attackers to access SharePoint deployments that have not been patched or otherwise mitigated,” Symantec states.
Related: Russian APT star Blizzard uses the “RedFlick” infection chain in recent attacks
Related: Hackers use custom ChatGPT GPTs in ClickFix attacks
Related: Daemon Tools Hackers’ NeedyMantis malware analyzed by Microsoft
Related: SmarterTools is affected by ransomware due to a security vulnerability in its own product
