Cybersecurity
Warlock exploits SharePoint flaws to deploy ransomware
Symantec and Carbon Black said Warlock used SharePoint vulnerabilities against organisations in Portuguese- and Spanish-speaking countries, disabled security tools on many hosts, and staged ransomware through domain replication.
- Symantec and Carbon Black said Warlock had attacked at least four organisations in the past two months.
- They said the victims included two critical infrastructure operators, a regional government body and a university in Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America.
- The group had earlier been linked to the ToolShell SharePoint zero-day campaign in mid-2025 and to a SmarterTools compromise through an unpatched SmarterMail instance.
- In one intrusion, attackers pushed a tool that disabled security software to at least 40 hosts and then deployed Warlock on at least 33 hosts via the domain SYSVOL share.
Symantec and Carbon Black said Warlock had been using Microsoft SharePoint vulnerabilities to reach organisations in Portuguese- and Spanish-speaking countries. The researchers said the activity had affected at least four organisations in the previous two months, including critical infrastructure, government and education targets.
The group was also known as Gold Salem, Longlegs and Storm-2603. Symantec said it had gained prominence in mid-2025 after the ToolShell SharePoint flaws were exploited to deliver ransomware, and it had earlier been connected with a SmarterTools compromise through an unpatched SmarterMail instance.
According to the researchers, one intrusion against a critical infrastructure operator saw a tool for disabling security software spread to at least 40 hosts in about two hours. Warlock was then placed on at least 33 hosts by storing it in the domain SYSVOL share so that normal replication carried it onwards.
Symantec said the attackers had used web shells on SharePoint servers to gather ASP.NET machine keys and then forge signed payloads that could run inside the SharePoint application pool. The group also used DLL sideloading, cloud file-sharing services, living-off-the-land tools and Visual Studio Code tunnels, and the researchers said activity seen on 22 July 2026 included discovery, code execution, lateral movement and ransomware deployment.
Named in this story
Companies
- Broadcom
- the owner of the reporting security unit
- SmarterTools
- a company previously linked to compromise
Organisations
- Warlock
- the threat actor carrying out the attacks
- Gold Salem
- an alias used for Warlock
- Longlegs
- an alias used for Warlock
- Storm-2603
- an alias used for Warlock
- Symantec and Carbon Black Threat Hunter Team
- the unit that observed and reported the activity
Products and systems
- Microsoft SharePoint
- the software whose flaws were exploited
- SmarterMail
- the unpatched instance used in an earlier intrusion
- Velociraptor
- a legitimate tool the group used for command-and-control
- K7RKScan.sys
- the vulnerable driver abused to disable security software
- Microsoft Visual Studio Code
- the software whose tunnel feature was abused
Places
- Europe
- one region where victims were located
- Africa
- one region where victims were located
- Latin America
- one region where victims were located
How the source tells it
The piece uses a measured threat-intelligence register, with some urgency from repeated references to active exploitation and a speculative close about the attackers’ motive.
- threat emphasis repeated references to active exploitation, ransomware deployment and security disabling
- speculation the closing sentence offers two possible motives without choosing between them