Warlock Ransomware Group Intensifies Targeting of SharePoint Servers Across Critical Infrastructure

The Warlock ransomware group remains a persistent and evolving threat, continuing its calculated campaign against critical infrastructure, government agencies, and educational institutions. According to new findings from threat intelligence researchers at Symantec, the group—believed to be operated by a China-based collective tracked variously as "Longlegs" and "Storm-2603"—is doubling down on the exploitation of SharePoint server vulnerabilities to gain initial access to high-value networks. This ongoing activity highlights the significant risks posed to organizations that have failed to patch or mitigate known flaws within their collaborative software environments.

The threat group known as Storm-2603 has been linked to a broad array of malicious operations, including those associated with monikers such as CL-CRI-1040, CamoFei, and the notorious ChamelGang. The group’s operational footprint has been expanding for years, with a specific focus on compromising the integrity of enterprise-grade server infrastructure. Their methodology, which relies heavily on a mix of sophisticated technical exploits and "living-off-the-land" tactics, has made them a formidable adversary for cybersecurity teams worldwide.

The group’s reliance on SharePoint vulnerabilities is not a recent development, but rather a refined strategy that began to garner significant attention last year. During that period, Chinese state-sponsored actors, including groups identified as Linen Typhoon and Violet Typhoon, were observed utilizing the "ToolShell" vulnerabilities. These flaws were exploited as zero-days at least two weeks before public disclosure, allowing the attackers to move through target networks with minimal interference. The impact of this campaign was profound, resulting in the compromise of more than 400 SharePoint servers within a matter of weeks, with U.S. government entities among the primary victims. Throughout this period, Storm-2603’s aggressive utilization of the ToolShell exploit distinguished them as one of the most active and dangerous participants in the threat landscape.

By October 2025, researchers had uncovered a string of Warlock ransomware attacks that directly leveraged the ToolShell exploit. The diversity of the victims served as a stark reminder of the group’s global reach, encompassing a Middle Eastern telecommunications firm, various government entities across Africa and South America, and at least one major university in the United States.

The latest intelligence report from Symantec indicates that Storm-2603 has not deviated from its core strategy, continuing to prioritize SharePoint bugs as the primary vector for infiltration. However, the group’s arsenal has evolved significantly. Beyond the well-documented ToolShell exploits, investigators have observed the group integrating a range of more recent, high-severity flaws into their toolkit. These include CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, CVE-2026-50522, and CVE-2026-55040. The inclusion of these vulnerabilities suggests a highly organized and well-resourced operation capable of quickly pivoting to new weaknesses as soon as they are identified.

The scale of the group’s recent activity is underscored by their focus on specific linguistic and regional markets. Over the past two months alone, Warlock operators have successfully breached at least four organizations located in Portuguese- and Spanish-speaking nations. The targets were not chosen at random; they included two critical infrastructure operators—a water utility and a telecommunications provider—as well as a regional government body and a university. This selection indicates a strategic focus on entities that provide essential services, likely intended to maximize the potential for extortion.

The technical execution of these intrusions follows a consistent and ruthless pattern. In one recent incident, the attackers deployed a specialized tool designed to neutralize security software across at least 40 individual systems. Once the defensive layers were stripped away, the threat actors proceeded to execute the Warlock ransomware payload on 33 of those systems, effectively paralyzing the organization’s digital operations.

Typically, the group initiates an attack by exploiting a SharePoint vulnerability, which is almost immediately followed by the deployment of a webshell. This allows the attackers to establish persistent access and begin exfiltrating sensitive data, such as ASP.NET machine keys. To facilitate remote code execution (RCE), the group deploys a forced signed payload, a tactic that often bypasses traditional security checks that might otherwise flag unauthorized software.

Storm-2603’s post-exploitation phase is characterized by the sophisticated use of DLL sideloading to execute code directly in memory, which helps avoid detection by file-based scanning tools. To maintain their grip on a compromised network, they often drop additional payloads from legitimate file-sharing and storage services, masking their malicious traffic as benign activity. Furthermore, the group makes extensive use of built-in administrative tools—a "living-off-the-land" approach—for reconnaissance and command execution, making it difficult for internal security teams to distinguish between legitimate administrator actions and malicious behavior.

One particularly notable tactic identified by Symantec is the abuse of the built-in tunnel feature within Visual Studio Code. The attackers install the code-insiders.exe binary as a service, allowing them to establish a covert, encrypted remote network access channel. Because this traffic originates from what appears to be a legitimate developer or administrator workstation, it frequently blends into the background noise of standard corporate network traffic, allowing the attackers to remain hidden for extended periods.

Once the attackers have successfully navigated the network and identified the core domain infrastructure, they employ a highly effective method for mass encryption. The Warlock payload is staged within the domain’s SYSVOL share. Because this directory is automatically replicated to every domain controller and is readable by any user within the domain, the ransomware can be pushed to and executed on every machine in the environment at once. This ability to strike at scale allows the group to inflict maximum damage in a very short window of time.

The persistence of the Longlegs group, more than a year after the Warlock ransomware first gained prominence, serves as a sobering reminder of the efficacy of these tactics. Despite the constant evolution of cybersecurity defenses, the exploitation of SharePoint vulnerabilities remains a highly viable initial access route for attackers, provided the underlying deployments have not been rigorously patched or appropriately mitigated. As long as organizations continue to operate vulnerable servers, they remain prime targets for a group that has demonstrated both the technical capability and the strategic intent to hold critical infrastructure hostage.

The broader cybersecurity community continues to monitor these developments closely. The ongoing threat posed by Storm-2603 underscores the importance of not only timely patch management but also the need for robust endpoint detection, network monitoring, and a deeper understanding of the "living-off-the-land" techniques that allow modern threat actors to operate with such dangerous stealth. The shift toward abusing developer-focused tools and legitimate services suggests that the battle against Warlock and similar groups will continue to be an arms race between attacker innovation and defensive vigilance.