Warlock (Malware): news timeline & CVEs

Warlock ransomware breach SharePoint in water, telecom operator attacks

Warlock ransomware exploited SharePoint ToolShell flaws to hit a water utility, telecom, government body, and university.

The China-linked Warlock ransomware group, tracked by Symantec as Longlegs and related to Microsoft's Storm-2603, attacked a water utility, a telecom provider, a regional government body, and a university. Initial access came from on-premises Microsoft SharePoint ToolShell flaws CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771, followed by a web shell. In a July 22 intrusion, the actor used a BYOVD EDR killer leveraging a signed K7RKScan driver (CVE-2025-1055) on at least 40 hosts, staged Warlock in SYSVOL, abused Visual Studio Code tunneling and NetExec, and encrypted at least 33 hosts on July 31.

BleepingComputer18:33 UTC · 4h agoRansomware in the wild 5 sources CVE-2025-49704 CVE-2025-49706 CVE-2025-53770+2 CVEs

'Warlock' ransomware used in attacks on critical infrastructure in Portuguese, Spanish-speaking countries

A Chinese group is deploying Warlock ransomware against critical infrastructure via unpatched SharePoint flaws.

Symantec’s Threat Hunter Team says a China-based group is using Warlock ransomware against organizations in Portuguese- and Spanish-speaking countries across Europe, Africa, and Latin America, including a water utility, a telecommunications provider, a university, and a regional government. The attackers exploited Microsoft SharePoint vulnerabilities, including the 2025 ToolShell flaws and newer 2026 bugs recently highlighted by CISA, and in one case disabled security software on dozens of hosts before deploying ransomware. Microsoft previously could not tie the operators to another tracked Chinese state group and said they had used LockBit before switching to Warlock. Last year’s related SharePoint campaign was alleged to have hit at least 400 organizations, including the National Nuclear Security Administration, NIH, and DHS.

The Recordupdated 18:33 UTC · 4h agofirst 14:05 UTC · 8h agoThreat actor in the wild 5 sources

Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks

Warlock ransomware operators continue exploiting unpatched SharePoint servers at critical infrastructure, government, and education targets.

Symantec says the Warlock ransomware group, linked to China-based Longlegs and Storm-2603, is still exploiting SharePoint at critical infrastructure, government, and education organizations. Over two months it hit at least four organizations in Portuguese- and Spanish-speaking countries, including a water utility, a telecommunications provider, a regional government body, and a university. In one intrusion, attackers disabled security software on at least 40 systems and ran Warlock on at least 33. The chain uses SharePoint bugs, including ToolShell and flaws such as CVE-2026-32201, then webshells, machine-key theft, DLL sideloading, a vulnerable driver, SYSVOL staging, and Visual Studio Code tunnels.

SecurityWeekupdated 18:33 UTC · 4h agofirst 09:34 UTC · 13h agoRansomware in the wild 5 sources CVE-2026-32201

Warlock Ransomware Hits Large Spanish, Portuguese Orgs

Warlock ransomware is hitting large Spanish and Portuguese organizations; the Chinese actor blends cybercrime and APT behavior.

Dark Reading reports that Warlock ransomware is hitting large organizations in Spain and Portugal. It describes the operator as a year-old Chinese threat actor that looks like a cybercrime gang while acting like a state-associated APT. The report says the group is attacking organizations in unexpected places. No named victims, ransom amounts, or technical details are included.

Dark Readingupdated 18:33 UTC · 4h agofirst Oct 1, 13:00 UTC · 1d agoRansomware in the wild 5 sources

Warlock

Timeline4 articles

Related CVEsby mentions

Appears with

Warlock ransomware breach SharePoint in water, telecom operator attacks

'Warlock' ransomware used in attacks on critical infrastructure in Portuguese, Spanish-speaking countries

Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks

Warlock Ransomware Hits Large Spanish, Portuguese Orgs