Warlock ransomware targets water, telecom, government and university networks

The China-linked ransomware group Warlock targeted a water utility, a telecom provider, a regional government body and a university, using SharePoint vulnerabilities to gain initial access, according to a report by Symantec and Carbon Black researchers.

Over the past two months, the threat actor appears to have focused on Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America. The group emerged in June 2025 and drew attention a month later by exploiting a chain of Microsoft SharePoint zero-days known as ToolShell: CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771. Microsoft later observed other hacking groups and a ransomware actor it tracks as Storm-2603 using ToolShell exploits.

Symantec identifies the actor as Longlegs and attributes Warlock’s development to the group. In one intrusion that began on July 22, researchers say the attackers disabled security software on “at least 40 hosts within about two hours,” then launched ransomware on at least 33 hosts.

The researchers say the attackers used a vulnerable signed driver, a web shell, and the domain’s SYSVOL share to spread the payload. They also found Visual Studio Code Insiders installed as a service for remote access and the open-source framework NetExec on one system. The ransomware deployment took place on July 31, after security protections were disabled.

The researchers warn that ToolShell and other SharePoint vulnerabilities remain viable ways to gain initial access. Their report includes indicators of compromise for files and infrastructure used in the attacks.