Back Broadcom

Warlock ransomware targets water and telecom operators

Broadcom • October 1, 2026

The China-nexus group behind Warlock ransomware is still breaking into organizations through Microsoft SharePoint vulnerabilities, a tactic that brought it to prominence a year ago. In the past two months, the group, which Symantec tracks as Longlegs (aka Storm-2603), attacked at least four organizations in Portuguese- and Spanish-speaking countries across Europe, Africa, and Latin America. The victims included two critical infrastructure operators, a water utility and a telecommunications provider, along with a regional government body and a university.

Symantec protects you from this threat, identified by the following:

SONAR.RansomPlay!gen1

SONAR.SuspLaunch!g193

Associated malicious indicators are blocked and detected by existing policies within Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from Carbon Black Cloud reputation service.

Machine Learning-based

Attack: Ransom.Gen Activity 29

Attack: Ransom.Gen Activity 47

Observed domains/IPs are covered under security categories in all WebPulse enabled products.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Warlock Ransomware Targets Critical Infrastructure in Spanish and Portuguese Regions The Warlock ransomware group, tracked as Longlegs or Storm-2603, has targeted critical infrastructure in Portuguese- and Spanish-speaking countries, including a water utility, a telecommunications provider, a regional government body, and an university. Recent attacks exploited vulnerabilities in Microsoft SharePoint, particularly the ToolShell exploit chain and potentially newer CVEs. The group has been observed using techniques such as DLL sideloading and a vulnerable signed driver to disable security software before deploying ransomware. In one incident, attackers disabled security software on 40 hosts within two hours and deployed Warlock on at least 33 of them by staging it in the domain's SYSVOL. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned about the of these vulnerabilities. The focus on critical sectors highlights the potential for significant disruption and data loss. 11 sources 79

Extracted Entities

Warlock ransomware targets water and telecom operators

The full story

Extracted Entities

APT Groups (2)

Attack Types (1)

Industries (2)

MITRE ATT&CK (2)

Platforms (1)

Ransomware Groups (1)