Warlock Ransomware Exploiting SharePoint Flaws to Attack Water and Telecom Operators

Cybersecuritynews •Guru Baran • October 1, 2026

A China-nexus threat actor is continuing to exploit Microsoft SharePoint Server vulnerabilities to deploy Warlock ransomware, with recent attacks striking essential-service and public-sector organizations across Portuguese- and Spanish-speaking countries. Symantec tracks the operator as Longlegs, while Microsoft uses Storm-2603; earlier activity has also been linked to CL-CRI-1040, CamoFei, and ChamelGang. During the past two months, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Warlock Ransomware Targets Critical Infrastructure in Spanish and Portuguese Regions The Warlock ransomware group, tracked as Longlegs or Storm-2603, has targeted critical infrastructure in Portuguese- and Spanish-speaking countries, including a water utility, a telecommunications provider, a regional government body, and an university. Recent attacks exploited vulnerabilities in Microsoft SharePoint, particularly the ToolShell exploit chain and potentially newer CVEs. The group has been observed using techniques such as DLL sideloading and a vulnerable signed driver to disable security software before deploying ransomware. In one incident, attackers disabled security software on 40 hosts within two hours and deployed Warlock on at least 33 of them by staging it in the domain's SYSVOL. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned about the of these vulnerabilities. The focus on critical sectors highlights the potential for significant disruption and data loss. 11 sources 79

Extracted Entities

Warlock Ransomware Exploiting SharePoint Flaws to Attack Water and Telecom Operators

The full story

Extracted Entities

APT Groups (5)

Attack Types (1)

Platforms (1)

Ransomware Groups (1)