Warlock Ransomware Group Expands SharePoint Attacks on Critical Infrastructure

The China-nexus threat group behind the Warlock ransomware strain is continuing to break into organizations through Microsoft SharePoint vulnerabilities, according to a new Symantec Threat Hunter Team report. Symantec, which tracks the group as Longlegs (also known as Storm-2603), says at least four victims in Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America were compromised over the past two months, including a water utility, a telecommunications provider, a university and a regional government.

SharePoint remains the preferred entry point

The campaign builds on the “ToolShell” SharePoint flaws that brought Warlock to prominence in 2025. Symantec’s researchers say the group’s current toolkit also draws on newer SharePoint vulnerabilities, including CVE-2026-32201 and CVE-2026-45659 among others, suggesting the operators are rotating through unpatched flaws rather than relying on a single exploit chain. The first observed activity in the latest wave traces to a webshell planted on a victim’s SharePoint server in July.

Why critical infrastructure keeps getting hit

Water utilities and telecommunications providers remain attractive targets for ransomware operators because SharePoint deployments inside these organizations are frequently internet-facing and slow to patch, a pattern Symantec’s data continues to confirm. The campaign is a reminder that cyber-physical security programs covering utilities and regional government networks need continuous SharePoint patch verification, not a one-time response triggered only when a named vulnerability makes headlines.

Sources and further reading

• Symantec/Broadcom threat intelligence report
• SecurityWeek coverage