Loading story…
Symantec attributed a campaign using Warlock ransomware to the China-nexus Longlegs group, also tracked as Storm-2603. The group exploited on-premises Microsoft SharePoint Server vulnerabilities to target at least four Portuguese- and Spanish-speaking organizations in Europe, Africa, and Latin America, including water and telecommunications operators, a regional government body, and a university.
Attackers used SharePoint web shells and forged machine-key-signed ViewState payloads to execute code, followed by reconnaissance, DLL sideloading, credential and domain enumeration, and lateral movement with legitimate or dual-use tools. Before encrypting systems, they distributed an AV/EDR-disabling utility consistent with BYOVD tradecraft and deployed Warlock to at least 33 systems through Active Directory's SYSVOL replication path, underscoring the ransomware risk posed by unpatched or inadequately mitigated SharePoint deployments.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
In a documented critical-infrastructure intrusion, the Longlegs group installed a webshell in the SharePoint LAYOUTS directory, establishing access through an on-premises SharePoint Server.
Warlock ransomware emerged and was later associated with exploitation of the Microsoft SharePoint ToolShell exploit chain.
Longlegs staged Warlock binaries run.exe and rune.exe in the compromised Active Directory domain's SYSVOL share, allowing domain replication to distribute them to at least 33 hosts; ransom notes named "how to restore your files.txt" were observed.
During the documented intrusion, an AV/EDR-killing tool named a.exe executed on at least 40 hosts in roughly two hours, consistent with an effort to disable security tooling before ransomware deployment.
Over the two months preceding the report, the China-nexus Longlegs group targeted at least four Portuguese- and Spanish-speaking organizations, including a water utility, telecommunications provider, regional government body, and university.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 24 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Warlock** ransomware operators have continued exploiting unpatched **Microsoft SharePoint** servers, but recent intrusions show a more mature post-exploitation playbook focused on persistence, lateral movement, and evasion after initial access. Trend Micro reported the group is now using a **bring your own vulnerable driver (BYOVD)** technique involving the `Nsec` driver, alongside tools such as **TightVNC** and the **Yuze** reverse proxy, to move more quietly across victim networks and reduce the chance of detection. The activity has affected organizations in the technology, manufacturing, and government sectors, with observed victims in the U.S., Germany, and Russia. Incident details show the operators escalating to **full domain compromise** by abusing credentials, resetting the built-in Administrator account, and adding users to the **Domain Administrators** group. They used **PsExec**, **PowerShell Remoting**, MSI-based deployment of TightVNC, and RDP-enabling utilities to maintain remote access and spread laterally, while web shells, tunneling, and other remote-control mechanisms supported persistence and command-and-control. The reporting indicates Warlock has kept its SharePoint exploitation path consistent, but has significantly strengthened the actions that follow compromise, giving defenders a clearer set of behaviors to hunt for beyond the initial server exploit.
Jun 29, 2026
Sophos reported that the ransomware group **Warlock Group**, tracked as **GOLD SALEM**, has been compromising enterprise networks and deploying **Warlock ransomware** since March 2025, with 60 publicly named victims through mid-September across North America, Europe, and South America. The operation used a Tor-based leak site, activity on underground forums, and possibly relationships with initial access brokers to support intrusions and extortion. Observed attacks began with exploitation of the **SharePoint ToolShell** exploit chain, followed by deployment of an **ASPX web shell** and a Golang-based WebSockets backdoor for persistence. Sophos said the actors stole credentials with **Mimikatz**, moved laterally with **PsExec** and **Impacket**, deployed ransomware through **Group Policy Objects**, and disabled endpoint protection using a **bring-your-own-vulnerable-driver** technique involving a vulnerable **Baidu Antivirus** driver; investigators also observed abuse of **Velociraptor** to establish a **Visual Studio Code** network tunnel. Microsoft tracks the activity as **Storm-2603** and assesses it with moderate confidence as China-based, though Sophos said it could not independently confirm that attribution.
Jun 29, 2026
Warlock ransomware was deployed against US firms through the exploitation of a zero-day vulnerability in Microsoft SharePoint, identified as CVE-2025-53770. The attacks have been attributed to the China-based CamoFei APT group, with evidence indicating that the threat actor leveraged the ToolShell exploit to gain initial access and deploy both Warlock and LockBit ransomware payloads. The campaign is notable for its use of DLL sideloading and a custom command and control framework referred to as `ak47c2`, as well as the bundling of multiple ransomware payloads in a single attack. Security researchers have traced the origins of the Warlock ransomware to activity dating back to 2019, suggesting that the group behind it is not new but has evolved its tactics. The operation stands out because, unlike most ransomware campaigns typically associated with Russian actors, Warlock is linked to Chinese threat groups, including Budworm (APT27), Sheathminer (APT31), and Storm-2603. The attacks highlight a growing trend of Chinese APTs engaging in financially motivated ransomware operations targeting Western organizations.
Jun 29, 2026