Warlock ransomware attackers have targeted a water utility, a telecommunications provider, a regional government body and a university through vulnerable SharePoint servers.
Researchers at Symantec and Carbon Black linked the intrusions to Longlegs, a China-linked group associated with Warlock’s development. During the past two months, its activity appears to have concentrated on Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America.
One investigation showed how quickly the attackers could spread ransomware after disabling security software. They deployed a protection-disabling tool to at least 40 computers within roughly two hours, then launched ransomware on at least 33.
SharePoint Flaws Provide an Entry Point
The group typically gains access by exploiting vulnerabilities in on-premises SharePoint installations. It then installs a web shell that supports multiple SharePoint versions, giving attackers a way to interact with compromised servers.
Warlock ransomware first appeared in June 2025. The following month, the group attracted attention through attacks involving the SharePoint vulnerability chain known as ToolShell.
That chain includes CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771. Microsoft tracks the associated ransomware actor as Storm-2603, while Symantec uses the name Longlegs.
Separately, Microsoft observed the state-backed groups Linen Typhoon and Violet Typhoon exploiting ToolShell. Those observations concern distinct actors using the same vulnerabilities.
Attackers Prepared the Network Before Encryption
In an intrusion that began on July 22, researchers observed reconnaissance activity two days after the initial compromise. The attackers also deleted files that appeared to serve as staging artifacts.
They placed the ransomware payload in the domain’s SYSVOL share. This location holds files that replicate across domain controllers.
As a result, attackers can use it to distribute a payload through logon scripts or Group Policy. That approach supports coordinated deployment across a network instead of separate delivery to each computer.
Meanwhile, the attackers installed the Visual Studio Code Insiders executable as a service. They used its built-in tunneling feature to establish remote connections to compromised machines.
Researchers also discovered NetExec on one system. This penetration-testing framework supported Active Directory discovery, credential spraying and remote command execution.
Vulnerable Driver Helped Disable Security Tools
In some Longlegs attacks, researchers identified a technique known as bring your own vulnerable driver, or BYOVD.
The attackers used a signed K7RKScan driver containing the vulnerability CVE-2025-1055. Through that driver, they deployed a tool designed to disable antivirus and endpoint detection and response protection.
The July intrusion reached its final stage on July 31. Researchers observed Warlock ransomware appearing on individual computers almost immediately after their protection stopped working.
Consequently, the sequence highlights the role of security-tool disruption in the deployment. The attackers weakened endpoint defenses before launching encryption across multiple machines.
SharePoint Remains a Route Into Networks
The findings show that ToolShell and other SharePoint vulnerabilities continue to provide entry points for attackers.
However, the reported targeting of water and telecommunications organizations does not establish disruption to water supplies or telecom services. The available account describes compromised IT environments and ransomware deployment.
Symantec and Carbon Black also published indicators of compromise covering files and infrastructure associated with the attacks. These details can support investigations into suspected Longlegs activity.
0 responses to “Warlock Ransomware Targets Water and Telecom Operators”