Warlock Keeps Exploiting SharePoint Flaws to Hit Critical Infrastructure

Researchers from the Symantec and Carbon Black Threat Hunter Team report that the suspected China-linked actor known as Warlock is still weaponizing Microsoft SharePoint vulnerabilities — likely both old and new — in attacks on organizations across Portuguese- and Spanish-speaking countries.

Over the past two months, the group — tracked by Broadcom as Longlegs — has hit at least four organizations: two critical infrastructure operators (a water utility and a telecommunications provider), a regional government body, and a university. The victims were located in Europe, Africa, and Latin America.

A familiar name

Warlock — also known as Gold Salem, Longlegs, and Storm-2603 — rose to prominence in mid-2025 over the zero-day exploitation of the "ToolShell" SharePoint flaws to deploy ransomware. Earlier this year it was linked to the compromise of SmarterTools through an unpatched SmarterMail instance. The attackers rely on the legitimate tool Velociraptor for command-and-control and on the bring-your-own-vulnerable-driver (BYOVD) technique to disarm security software. According to Symantec, Warlock's activity overlaps with the older clusters CL-CRI-1040, CamoFei, and ChamelGang.

How the attack unfolds

After breaking in through on-premises SharePoint flaws, the attackers drop web shells whose goal is to harvest the SharePoint farm's ASP.NET machine keys. Those keys are then abused to forge a validly signed payload, opening the door to remote code execution inside the SharePoint application pool.

From there come the tried-and-tested tricks: loading malicious code into memory via DLL sideloading, pulling follow-on payloads from legitimate cloud storage (catbox.moe, wasabisys.com) to stay under the radar, and abusing the vulnerable driver K7RKScan.sys (CVE-2025-1055) — the same one previously used by DragonForce operators. Built-in Windows tooling handles reconnaissance, while Visual Studio Code's tunnel feature provides remote access.

The scale is striking: in one intrusion against a critical infrastructure operator, a tool built to disable security software was pushed to at least 40 hosts in roughly two hours, after which the ransomware was deployed on at least 33 machines — staged in the domain's SYSVOL share, where ordinary replication delivered it automatically.

The most recent episode dates to July 22, 2026. More than a year after Warlock first came to prominence, the researchers say, exploiting ToolShell remains a viable initial-access route for unpatched SharePoint deployments. The focus on Portuguese- and Spanish-speaking countries may point either to opportunistic targeting of exposed vulnerable servers or to a more deliberate tasking.

Source: The Hacker News