Linen Typhoon (Threat actor): news timeline & CVEs

Related CVEsby mentions

CVE-2026-586449.816%

Unauthenticated Deserialization RCE in Microsoft SharePoint Server

published Jul 14, 2026· Microsoft SharePoint Server (on-premises) KEV

CVE-2026-561649.81%

Missing Authentication in Microsoft SharePoint Server Allows Privilege Escalation

published Jul 14, 2026· Microsoft SharePoint Server KEV

CVE-2026-505229.83%

Unauthenticated Deserialization RCE in Microsoft SharePoint Server

published Jul 14, 2026· Microsoft SharePoint Server (on-premises) KEV

CVE-2025-537709.8100%

Unauthenticated Deserialization RCE in Microsoft SharePoint Server on-premises

published Jul 20, 2025· Microsoft SharePoint Server (on-premises) KEV ransomware PoC ×3

CVE-2026-550409.118%

Authentication Bypass in Microsoft SharePoint Server

published Jul 14, 2026· Microsoft SharePoint Server KEV PoC ×2

CVE-2026-456598.83%

Authenticated Deserialization RCE in Microsoft SharePoint Server (Actively Exploited)

published May 22, 2026· Microsoft SharePoint Server KEV ransomware

CVE-2025-497048.8100%

Authenticated Code Injection RCE in Microsoft SharePoint

published Jul 8, 2025· Microsoft SharePoint KEV ransomware

CVE-2026-322016.543%

Improper Input Validation Spoofing Vulnerability in Microsoft SharePoint Server

published Apr 14, 2026· Microsoft SharePoint Server KEV

CVE-2025-537716.5100%

Improper Authentication in Microsoft SharePoint Server Enables Network Spoofing

published Jul 20, 2025· Microsoft SharePoint Server (on-premises)

CVE-2025-10555.6<1%

A vulnerability in the K7RKScan.sys driver, part of the K7 Security Anti-Malware suite, allows a local low-privilege user to send crafted IOCTL requests to…

published Jun 11, 2025

Warlock ransomware breach SharePoint in water, telecom operator attacks

Warlock ransomware exploited SharePoint ToolShell flaws to hit a water utility, telecom, government body, and university.

The China-linked Warlock ransomware group, tracked by Symantec as Longlegs and related to Microsoft's Storm-2603, attacked a water utility, a telecom provider, a regional government body, and a university. Initial access came from on-premises Microsoft SharePoint ToolShell flaws CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771, followed by a web shell. In a July 22 intrusion, the actor used a BYOVD EDR killer leveraging a signed K7RKScan driver (CVE-2025-1055) on at least 40 hosts, staged Warlock in SYSVOL, abused Visual Studio Code tunneling and NetExec, and encrypted at least 33 hosts on July 31.

BleepingComputer18:33 UTC · 3h agoRansomware in the wild 5 sources CVE-2025-49704 CVE-2025-49706 CVE-2025-53770+2 CVEs

Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks

Warlock ransomware operators continue exploiting unpatched SharePoint servers at critical infrastructure, government, and education targets.

Symantec says the Warlock ransomware group, linked to China-based Longlegs and Storm-2603, is still exploiting SharePoint at critical infrastructure, government, and education organizations. Over two months it hit at least four organizations in Portuguese- and Spanish-speaking countries, including a water utility, a telecommunications provider, a regional government body, and a university. In one intrusion, attackers disabled security software on at least 40 systems and ran Warlock on at least 33. The chain uses SharePoint bugs, including ToolShell and flaws such as CVE-2026-32201, then webshells, machine-key theft, DLL sideloading, a vulnerable driver, SYSVOL staging, and Visual Studio Code tunnels.

SecurityWeekupdated 18:33 UTC · 3h agofirst 09:34 UTC · 12h agoRansomware in the wild 5 sources CVE-2026-32201

Linen Typhoon

Timeline2 articles

Related CVEsby mentions

Appears with

Warlock ransomware breach SharePoint in water, telecom operator attacks

Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks