Warlock Exploits Share Point Flaws to Disable Security Tools and Deploy Ransomware
Summary: Symantec and Carbon Black observed the suspected China-linked actor Warlock, also tracked as Longlegs, attacking at least four organizations in the past two months, including a water utility, a telecommunications provider, a regional government body, and a university in Portuguese- and Spanish-speaking countries across Europe, Africa, and Latin America. In one intrusion against a critical infrastructure operator, the attackers pushed a tool to disable security software to at least 40 hosts within about two hours, then deployed Warlock ransomware on at least 33 hosts by staging it in the domain's SYSVOL share, after using SharePoint web shells to steal ASP.NET machine keys and forge signed payloads for remote code execution.
What's compelling: A tool that disables security software reached 40 hosts in roughly two hours, and ordinary domain replication carried the ransomware to 33 more - meaning the domain's own plumbing did the lateral movement. Symantec notes exploitation of ToolShell and related SharePoint flaws remains a viable initial access route more than a year after Warlock first came to prominence, for any on-premises SharePoint deployment left unpatched.
Read the original at The Hacker News ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026