Warlock ransomware breach SharePoint in water, telecom operator attacks

Security researchers at Symantec and Carbon Black report that the China-linked Warlock ransomware gang, also tracked as Longlegs, has been breaching critical infrastructure by exploiting on-premises Microsoft SharePoint vulnerabilities. Victims include a water utility, a telecom provider, a regional government agency, and a university, mostly in Portuguese- and Spanish-speaking countries across Europe, Africa, and Latin America, over the past two months. The group first gained attention after abusing the ToolShell exploit chain (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771), and Microsoft has separately linked related SharePoint exploitation to state-backed actors Linen Typhoon, Violet Typhoon, and a ransomware operator dubbed Storm-2603. In a documented intrusion starting July 22, attackers used a web shell compatible with multiple SharePoint versions, then deployed an AV/EDR-killing tool via a vulnerable signed driver (CVE-2025-1055) to disable defenses on roughly 40 hosts within two hours, before launching Warlock ransomware on at least 33 systems—staging the payload through the domain's SYSVOL share and using VS Code's tunneling feature and the NetExec framework for lateral movement and credential theft.