Loading story…
The China-nexus group behind Warlock ransomware, tracked as Longlegs and Storm-2603, has shifted toward fewer, higher-value targets in Spanish- and Portuguese-speaking countries. According to Symantec findings reported by WaterISAC, the group attacked at least four organizations across Europe, Africa, and Latin America over the preceding two months: a water utility, telecommunications provider, regional government body, and university. The attackers exploit on-premises Microsoft SharePoint vulnerabilities for initial access, then use DLL sideloading, a vulnerable signed driver to disable security tools, and living-off-the-land techniques.
Warlock operators stage ransomware in a domain controller’s SYSVOL share, using normal Active Directory replication to distribute the payload across domain controllers. This approach may evade detections focused on conventional remote execution. WaterISAC recommends verifying SharePoint patches, treating previously exposed servers as potentially compromised, monitoring SYSVOL and domain controllers, and restricting unnecessary remote tunneling. The accompanying vulnerability references identify SharePoint flaws CVE-2025-49706 and CVE-2025-53770; defenders should include these in remediation checks rather than assume patching alone rules out an existing compromise.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
WaterISAC published an alert describing Warlock's SharePoint exploitation and staging of ransomware in a domain controller's SYSVOL share, allowing Active Directory replication to distribute the payload. It recommended verifying SharePoint patches, investigating previously exposed servers, monitoring domain controllers and SYSVOL, and restricting unnecessary remote tunneling.
During the early hours of July 31, Longlegs distributed an AV/EDR-killing utility that executed on at least 40 additional hosts within approximately two hours during a critical infrastructure intrusion. Warlock followed almost immediately, with ransomware binaries and ransom notes recorded on at least 33 hosts.
Symantec reported that the China-nexus Warlock group, tracked as Longlegs and Storm-2603, attacked at least four organizations during the preceding two months, including a water utility, telecommunications provider, regional government body, and university. The campaign reflected a shift toward fewer, higher-value targets in Spanish- and Portuguese-speaking countries.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
blog.polyswarm.io
Open sourcewaterisac.org
Open sourcecve.org
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Symantec attributed a campaign using **Warlock ransomware** to the China-nexus Longlegs group, also tracked as Storm-2603. The group exploited on-premises Microsoft SharePoint Server vulnerabilities to target at least four Portuguese- and Spanish-speaking organizations in Europe, Africa, and Latin America, including water and telecommunications operators, a regional government body, and a university. Attackers used SharePoint web shells and forged machine-key-signed ViewState payloads to execute code, followed by reconnaissance, DLL sideloading, credential and domain enumeration, and lateral movement with legitimate or dual-use tools. Before encrypting systems, they distributed an AV/EDR-disabling utility consistent with **BYOVD** tradecraft and deployed Warlock to at least 33 systems through Active Directory's `SYSVOL` replication path, underscoring the ransomware risk posed by unpatched or inadequately mitigated SharePoint deployments.
Oct 5, 2026
Warlock ransomware operators exploited Microsoft SharePoint’s **ToolShell vulnerabilities**, including CVE-2025-53770, to compromise enterprise networks, steal data and deploy ransomware. Microsoft tracks the actor as Storm-2603; Palo Alto Networks Unit 42 assessed with high confidence that it matches its CL-CRI-1040 cluster. The operation uses the Project AK47 toolset, including a DNS/HTTP command-and-control backdoor, DLL sideloading loaders and AK47/X2ANYLOCK ransomware. Warlock is a LockBit 3.0 derivative that appends the `.x2anylock` extension to encrypted files. Researchers linked the operators to earlier LockBit affiliate activity and a Warlock-branded double-extortion site, with victims spanning multiple continents and sectors, including critical infrastructure. Observed intrusions involved web shells, credential theft, lateral movement, Group Policy abuse, security-tool disabling and RClone-based data exfiltration; attackers also exploited outdated Veeam installations vulnerable to CVE-2023-27532. Symantec and Carbon Black found malicious 7z.dll loaders and defense-evasion tools using a stolen coolschool signing certificate and a vulnerable Baidu driver in attacks against a Middle Eastern engineering company and a U.S. firm. Certificate reuse suggests a possible connection to CamoFei/ChamelGang, but that historical link and a proposed mix of espionage and financially motivated activity remain tentative. Microsoft assessed Storm-2603 as China-based, while Unit 42 reported insufficient evidence for confident nation-state attribution. Defenders should prioritize SharePoint and Veeam patching and hunt for suspicious DLL loading, vulnerable-driver abuse, unauthorized Group Policy changes and AK47 command-and-control activity.
Oct 9, 2026
Sophos reported that the ransomware group **Warlock Group**, tracked as **GOLD SALEM**, has been compromising enterprise networks and deploying **Warlock ransomware** since March 2025, with 60 publicly named victims through mid-September across North America, Europe, and South America. The operation used a Tor-based leak site, activity on underground forums, and possibly relationships with initial access brokers to support intrusions and extortion. Observed attacks began with exploitation of the **SharePoint ToolShell** exploit chain, followed by deployment of an **ASPX web shell** and a Golang-based WebSockets backdoor for persistence. Sophos said the actors stole credentials with **Mimikatz**, moved laterally with **PsExec** and **Impacket**, deployed ransomware through **Group Policy Objects**, and disabled endpoint protection using a **bring-your-own-vulnerable-driver** technique involving a vulnerable **Baidu Antivirus** driver; investigators also observed abuse of **Velociraptor** to establish a **Visual Studio Code** network tunnel. Microsoft tracks the activity as **Storm-2603** and assesses it with moderate confidence as China-based, though Sophos said it could not independently confirm that attribution.
Jun 29, 2026