The group behind Warlock ransomware broke into at least four organizations in Portuguese- and Spanish-speaking countries over two months, according to a Symantec Threat Hunter Team report, and it got in the way it did a year ago: through Microsoft SharePoint Server.
What Symantec reported
Symantec tracks the actor as Longlegs, also known as Storm-2603, and describes it as a China-nexus group. Symantec says it has previously tied the group to older activity clusters known as CL-CRI-1040, CamoFei and ChamelGang. In the past two months the group attacked at least four organizations, according to the report: a water utility, a telecommunications provider, a regional government body and a university. The victims sit in Europe, Africa and Latin America.
Warlock emerged in June 2025. Weeks later, Symantec notes, attackers deploying it were found exploiting zero-day flaws in SharePoint Server that became known as ToolShell, tracked as CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771. Symantec writes that those flaws “likely remain in the group’s arsenal” alongside newer SharePoint flaws that CISA warned about in an advisory published in July 2026.
How one intrusion unfolded
Symantec walks through an attack on a critical infrastructure operator. The first malicious activity it observed was on July 22, 2026, when a webshell was placed on a SharePoint server. Symantec says the webshell exists to harvest the SharePoint farm’s ASP.NET machine keys, which the attackers then use to forge a validly signed payload and run code inside the SharePoint application pool.
From there the report describes a slow first week and a fast last day. Over the next several days the attackers ran reconnaissance, fetched follow-on payloads from public file-hosting services, and added an account with a SharePoint-style name to the local administrators group on further hosts. Symantec says they also used the Visual Studio Code tunnel feature on one machine for remote access, which can blend into traffic that normally comes from developer and administrator workstations.
The ransomware stage began in the early hours of July 31. Symantec says the attackers pushed a tool that disables security software to at least 40 hosts within about two hours, then deployed Warlock on at least 33 hosts. The payload was staged in the domain’s SYSVOL share, so ordinary domain replication delivered it to machines. In other recent attacks, Symantec says, the group disabled security products by abusing K7RKScan, a signed but vulnerable driver tracked as CVE-2025-1055.
By our count of Symantec’s timeline, about nine days passed between the first webshell and the ransomware. The last two of those steps, disabling defenses and encrypting hosts, took roughly two hours.
Why year-old flaws still work
Symantec’s own summary is that continued activity more than a year after Warlock first made headlines shows ToolShell and related SharePoint vulnerabilities remain a viable way in for attackers wherever SharePoint deployments have not been patched or otherwise mitigated. It also says the focus on Portuguese- and Spanish-speaking countries could reflect opportunism driven by exposed, vulnerable servers, or a more deliberate tasking. The report does not choose between the two.
Our read, labelled as ours: the machine-key step matters more than the CVE list. Symantec describes keys being harvested and then reused to sign payloads. A key that was copied while a server was vulnerable keeps its value after the patch lands, so a patched server is not automatically a clean one. We have followed SharePoint exploitation before, including CISA’s confirmation of active exploits for a flaw we flagged, and the pattern in that coverage and in this report is the same: exposure lasts longer than the advisory cycle.
The step that disables security software also fits a theme we have covered in attackers targeting the consoles that secure you. Once defenses are switched off on dozens of hosts at the same time, detection that depends on those agents goes quiet exactly when it is needed.
What it means for the security leader
Three questions are worth putting to the team this week.
First, where does on-premises SharePoint still run, and is any of it reachable from the internet? Symantec’s victim list includes a water utility and a telecommunications provider, which are the kind of operators that keep older collaboration servers alive for years.
Second, for any server that was exposed while the ToolShell flaws or the newer July 2026 flaws were unpatched, has anyone rotated the machine keys, not just applied the update? Check Microsoft’s current guidance for the exact procedure. This is our recommendation and not a finding from the report.
Third, would you see the last two hours? The behaviors Symantec lists are visible to a team that is looking for them: a new executable arriving through the domain’s replicated script share, one tool copied to dozens of hosts in minutes, a developer tunnel service installed on a server, and a signed driver loading that does not belong on the machine. Symantec publishes file hashes and two network indicators with the report for teams that want to hunt back through July.
Actions for defenders
- Confirm every on-premises SharePoint server is on a build that fixes the four ToolShell CVEs and the flaws in CISA’s July 2026 advisory, and take unpatched servers off the internet.
- Rotate ASP.NET machine keys on servers that were exposed while vulnerable, following Microsoft’s guidance.
- Alert on writes to the domain’s replicated script share by accounts that do not normally write there.
- Block known-vulnerable signed drivers, including the one tracked as CVE-2025-1055, using the platform’s driver blocklist.
- Alert on a Visual Studio Code tunnel service installed on any server.
- Run the hashes and network indicators in Symantec’s report against logs from July onward.
Source: Symantec Threat Hunter Team, Warlock Ransomware Attackers Hit Water and Telecom Operators
