Warlock Ransomware Exploiting SharePoint Flaws to Attack Water and Telecom Operators

What happened?

A China-nexus threat actor is continuing to exploit Microsoft SharePoint Server vulnerabilities to deploy Warlock ransomware, with recent attacks striking essential-service and public-sector organizations across Portuguese- and Spanish-speaking countries. Symantec tracks the operator as Longlegs, while Microsoft uses Storm-2603; earlier activity has also been linked to CL-CRI-1040, CamoFei, and ChamelGang. During the past two months, the campaign compromised at least four organizations: a water

Key details

• Warlock ransomware surfaced in June 2025 and was deployed through the SharePoint ToolShell exploit chain using CVE-2025-49704 and CVE-2025-49706.
• Webshells enabled unauthorized access, internal configuration exposure, and remote code execution on on-premises SharePoint servers.
• Defenders should hunt webshells, rotate machine keys, enable AMSI Full Mode, and restrict SharePoint internet exposure after suspected exploitation.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.