Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks

Symantec warns that the Warlock ransomware operation, run by the China-linked actor tracked as Longlegs/Storm-2603, keeps breaking into unpatched Microsoft SharePoint servers to hit critical infrastructure, government and education targets. Besides the earlier ToolShell flaws, the group is now believed to also leverage newer SharePoint bugs including CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, CVE-2026-50522 and CVE-2026-55040 to gain initial access. In the past two months alone, at least four organizations across Portuguese- and Spanish-speaking countries were compromised, among them a water utility, a telecom provider, a regional government agency and a university, with attackers disabling security tools on dozens of machines before deploying the Warlock encryptor at scale through SYSVOL replication. The campaign highlights that more than a year after Warlock first appeared, exploitation of SharePoint vulnerabilities remains an effective entry point for organizations that have not applied patches or mitigations.