Warlock Ransomware Exploits ToolShell SharePoint Vulnerabilities
Article Content
Browse articles 
Warlock ransomware has been deployed through vulnerabilities in ToolShell SharePoint. Organizations using affected SharePoint versions are at risk, as the ransomware exploits chained vulnerabilities to gain access. Technical details indicate that the attack vector relies on specific weaknesses within the SharePoint infrastructure.
Ask AI about this cluster
Answers cite the sources they use
Updated 229d ago How this analysis works
More articles in this cluster (2)
Following this threat?
Track Warlock in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Warlock Ransomware Targets Critical Infrastructure in Spanish and Portuguese Regions The Warlock ransomware group, tracked as Longlegs or Storm-2603, has targeted critical infrastructure in Portuguese- and Spanish-speaking countries, including a water utility, a telecommunications provider, a regional government body, and an university. Recent attacks exploited vulnerabilities in Microsoft SharePoint… 
Critical RCE Vulnerabilities in GitLab and Dell; Warlock Ransomware Targets SharePoint GitLab and Dell released critical patches for remote code execution vulnerabilities on October 3, 2026. GitLab's AI Gateway vulnerability (CVE-2026-90970) allows arbitrary command execution on self-hosted instances, with a CVSS score of 9.9. Dell's Container Storage Modules have critical flaws (CVSS 10.0) enabling…