Reported by 13 outlets
Warlock ransomware breach SharePoint in water, telecom operator attacks
Why this score
- Breadth
- 2.00 / 2.0 · 13 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.50 / 2.0 · updates in 48h
- Pickup speed
- 0.27 / 0.6 · time to second source
- Recency
- × 0.34 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 3.2 / 10 = base × recency + community
Desk analysis
Warlock ransomware continues to exploit year-old SharePoint flaws (including CVE-2025-49704, CVE-2025-49706, and others) to breach critical infrastructure sectors, including water utilities and telecom operators. The group uses unpatched SharePoint instances as initial access. Organizations should prioritize SharePoint patching and segment critical operational networks from web-facing collaboration platforms.
Timeline
-
original reporting
Warlock ransomware breach SharePoint in water, telecom operator attacks
bleepingcomputer.com · 11d ago · October 2nd, 2026
The China-linked ransomware group Warlock targeted a water utility, a telecom provider, a regional government body, and a university by exploiting SharePoint vulnerabilities to gain initial access. Over the past two months, the threat actor appears to have focused on countries speaking Portuguese and Spanish across Europe, Africa, and Latin America. The gang emerged in June 2025 and gained notoriety a month later after exploiting a chain of zero-day vulnerabilities in Microsoft SharePoint known as ToolShell (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771). By August, Microsoft observed state-backed hacking groups Linen Typhoon and Violet Typhoon using ToolShell exploits in attacks, along with a ransomware threat actor the company tracks as Storm-2603. Cybersecurity company Symantec identifies the same actor as Longlegs and attributes the development of the Warlock ransomware to the group. According to the researchers, in one intrusion that started on July 22, the threat actor deployed a tool that disabled protection software on “at least 40 hosts within about two hours.” The attacker then launched Warlock ransomware on at least 33 hosts. After gaining access, typically by exploiting vulnerabilities in on-premises SharePoint deployments, the attacker drops a web shell designed to function across multiple SharePoint versions. Symantec and Carbon Black researchers say that in some attacks attributed to Longlegs, an AV/EDR-killing tool was deployed via the br
-
update from www.security.com
(security.com) Warlock Ransomware: China-Nexus Threat Actor Longlegs Exploits SharePoint Vulnerabilities to Target Critical Infrastructure I
www.security.com · 12d ago · October 1st, 2026
(security.com) Warlock Ransomware: China-Nexus Threat Actor Longlegs Exploits SharePoint Vulnerabilities to Target Critical Infrastructure I
via Mastodon https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure
-
update from securityweek.com
Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks
securityweek.com · 11d ago · October 2nd, 2026
The Warlock ransomware group continues to target SharePoint servers in attacks against critical infrastructure, government, and education entities, Symantec reports. Warlock is believed to be operated by a China-based hacking group tracked as Longlegs and Storm-2603, which has been linked to malicious operations such as CL-CRI-1040, CamoFei, and ChamelGang. Last year, the Chinese state-sponsored groups Linen Typhoon and Violet Typhoon were seen exploiting two SharePoint vulnerabilities dubbed ToolShell as zero-days at least two weeks before public disclosure . Within weeks, more than 400 SharePoint servers were compromised, and Storm-2603’s exploitation of ToolShell stood out amid heavy APT activity. By October 2025, researchers uncovered numerous Warlock ransomware attacks that exploited ToolShell. Some of the group’s victims included a Middle East telecom firm, African and South American government entities, and a US university. According to a fresh Symantec report , Storm-2603 continues to favor the exploitation of SharePoint bugs in attacks. In addition to ToolShell, its arsenal may also include recent flaws such as CVE-2026-32201, CVE-2026-45659, CVE-2026-56164 , CVE-2026-58644 , CVE-2026-50522 , and CVE-2026-55040 .
-
update from www.urbanmind.net
Warlock Ransomware Uses Year-Old SharePoint ToolShell Flaws Against a Water Utility and a Telecom # cybersecurity # infosec # security # sof
www.urbanmind.net · 11d ago · October 2nd, 2026
Warlock Ransomware Uses Year-Old SharePoint ToolShell Flaws Against a Water Utility and a Telecom # cybersecurity # infosec # security # sof
via Mastodon https://www.urbanmind.net/search?tag=cybersecurity
-
mentioned by www.bleepingcomputer.com
🤖 Warlock ransomware (China-linked, aka Longlegs/Storm-2603) hit a water utility, a telecom operator, a regional gov and a university via th
www.bleepingcomputer.com · 11d ago · October 3rd, 2026
-
mentioned by www.bleepingcomputer.com
Warlock ransomware breach SharePoint in water, telecom operator attacks The China-linked ransomware group Warlock targeted a water utility,
www.bleepingcomputer.com · 11d ago · October 3rd, 2026
-
mentioned by cyberworldops.eu
China-linked Warlock exploited on-premises SharePoint flaws to deploy ransomware on at least 33 hosts. Victims include water, telecom, gover
cyberworldops.eu · 11d ago · October 3rd, 2026
-
update from osintsights.com
Warlock Targets SharePoint Deployments with Ransomware via Exploited Flaws Warlock, a suspected China-linked threat actor, has launched targ
osintsights.com · 10d ago · October 3rd, 2026
Warlock Targets SharePoint Deployments with Ransomware via Exploited Flaws Warlock, a suspected China-linked threat actor, has launched targ
via Mastodon https://osintsights.com/warlock-targets-sharepoint-deployments-with-ransomware-via-exploited-flaws?utm_source=mastodon&utm_medium=social
-
update from thehackernews.com
🤖 China-linked actor Warlock is weaponizing Microsoft SharePoint flaws (old and new) to disable security tooling and deploy ransomware. Targ
thehackernews.com · 10d ago · October 3rd, 2026
🤖 China-linked actor Warlock is weaponizing Microsoft SharePoint flaws (old and new) to disable security tooling and deploy ransomware.
-
update from thehackernews.com
Reward: Equipped [Ransomware Binary] — Durability: yours is gone. Stats: -200 uptime, -150 data integrity. Your security tools have been une
thehackernews.com · 10d ago · October 4th, 2026
Reward: Equipped [Ransomware Binary] — Durability: yours is gone. Stats: -200 uptime, -150 data integrity.
-
update from securityaffairs.com
Warlock ransomware exploits year-old SharePoint flaws to hit critical infrastructure
securityaffairs.com · 9d ago · October 4th, 2026
The campaign is active and hits critical sectors. Watch for new victim announcements and whether patched SharePoint instances are still exposed.
-
update from thehackernews.com
A group is using flaws in file-sharing software to turn off security tools and lock up important files. If you use business software, make s
thehackernews.com · 9d ago · October 4th, 2026
A group is using flaws in file-sharing software to turn off security tools and lock up important files. If you use business software, make s
via Mastodon https://thehackernews.com/2026/10/warlock-exploits-sharepoint-flaws-to.html
-
mentioned by thehackernews.com
🤖 China-linked actor Warlock is weaponizing Microsoft SharePoint flaws to disable security tooling and deploy ransomware. Symantec/Carbon Bl
thehackernews.com · 9d ago · October 4th, 2026
-
mentioned by www.bleepingcomputer.com
# Warlock # ransomware breach # SharePoint in # water , telecom operator attacks https://www. bleepingcomputer.com/news/secu rity/warlock-ra
www.bleepingcomputer.com · 9d ago · October 4th, 2026
-
mentioned by securityonline.info
The Warlock ransomware group still exploits SharePoint vulnerabilities, hitting a water utility, a telecom firm, and more. Here is how to de
securityonline.info · 9d ago · October 5th, 2026
-
update from socfortress.medium.com
Warlock Ransomware Targets Critical Infrastructure
socfortress.medium.com · 8d ago · October 5th, 2026
Once inside, they employ advanced evasion tactics such as DLL sideloading, bringing their own vulnerable drivers to disable security software, and abusing Visual Studio Code tunnels for covert remote access. To distribute the ransomware widely, the threat actors stage their malicious payloads inside the domain’s SYSVOL share , allowing automated replication to spread the infection across numerous machines simultaneously. Cybersecurity platforms utilize unified threat tracking and behavioral analysis to intercept these complex multi-stage attacks before encryption occurs. Threat Actor Lineage and Identity Matrix Longlegs is a China-nexus cyber threat group that gained significant prominence following high-profile exploitation campaigns targeting enterprise web servers to deploy Warlock ransomware. Security telemetry directly links Longlegs to several historical threat activity clusters and operational aliases previously documented across industry research, including CL-CRI-1040, CamoFei, and ChamelGang. These designations represent earlier operational iterations or overlapping thre
-
mentioned by diesec.com
Warlock ransomware still enters via on-prem SharePoint: Symantec links it to a water utility and a telecom attack. EDR killer on 40+ hosts i
diesec.com · 6d ago · October 7th, 2026
-
mentioned by diesec.com
(diesec.com) Warlock Ransomware Exploits SharePoint Vulnerabilities to Target Critical Infrastructure Across Europe, Africa, and Latin Ameri
diesec.com · 6d ago · October 7th, 2026
-
mentioned by blog.polyswarm.io
(blog.polyswarm.io) China-Nexus Threat Actor Longlegs Exploits SharePoint Vulnerabilities to Deploy Warlock Ransomware in Critical Infrastru
blog.polyswarm.io · 4d ago · October 9th, 2026
-
mentioned by cyber.netsecops.io
📰 Warlock Ransomware Hits Critical Sectors via Old SharePoint Flaws The Warlock ransomware group is exploiting year-old SharePoint flaws (To
cyber.netsecops.io · 1d ago · October 12th, 2026
-
mentioned by cyber.netsecops.io
📰 Warlock Ransomware Hits Critical Sectors via Old SharePoint Flaws The Warlock ransomware group is exploiting year-old SharePoint flaws (To
cyber.netsecops.io · 15h ago · October 13th, 2026