# Warlock Ransomware Attackers Hit Water and Telecom Operators via SharePoint ToolShell Exploitation (Longlegs / Storm-2603)

> China-nexus actor Longlegs (aka Storm-2603) is exploiting Microsoft SharePoint ToolShell vulnerabilities (CVE-2025-49704/49706/53770/53771) to deploy Warlock ransomware against water utilities, telecom providers, a regional government body and a university in Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America. In one July 2026 intrusion Warlock reached 33+ hosts via SYSVOL replication after an AV/EDR killer using the vulnerable K7RKScan driver was run.

- **Published:** 2026-10-01T00:00:00Z
- **Last reviewed:** 2026-10-04T12:33:51.907Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2833
- **ID:** TL-2026-2833
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Longlegs (China)
- **Detections:** 9 · **IOCs:** 46 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771, CVE-2025-1055

## Description

Symantec's Threat Hunter Team (published 2026-10-01) reports at least four organizations hit over roughly two months: a water utility, a telecommunications provider, a regional government body and a university, all in Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America. Earlier Warlock activity spanned the US, Brazil, India, Russia, Taiwan and Japan. Symantec attributes the activity to Longlegs (aka Storm-2603), a China-nexus actor, and links it to the CL-CRI-1040, CamoFei and ChamelGang clusters. Warlock emerged in June 2025 and exploited the ToolShell SharePoint zero-days weeks later.

Initial access is the ToolShell chain against on-premises SharePoint (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771), using forged, machine-key-signed __VIEWSTATE payloads to execute code in the SharePoint application pool. In the detailed intrusion, a PowerShell command wrote the webshell layout2sp.aspx into the SharePoint 14 hive template\layouts directory on 2026-07-22. The actor then ran reconnaissance (net user /domain, whoami, nltest /domain_trusts), cleaned up staging artifacts, issued an outbound request to a Burp Collaborator (oastify.com) canary, re-tested the webshell, and loaded System.Workflow.ComponentModel via reflection in PowerShell as part of the exploit chain. ASP.NET machine keys were harvested to forge payloads.

On 2026-07-29 the domain account SPSEPRDSetup was added to the local Administrators group and Visual Studio Code Insiders was installed as a tunnel service (code-insiders.exe tunnel service install --accept-server-license-terms) for covert remote access that blends with developer traffic. Payload MSIs were pulled with msiexec /q /i from file-sharing/cloud storage (litter.catbox.moe, s3.wasabisys.com/fortifs, xn8xyt-drop.s3.wasabisys.com). Persistence and execution used DLL sideloading pairs (ssvagent.exe + gsdll64.dll.tmp, logger.exe + doexeloc.dll.tmp, doexe.exe + doexeloc.dll). NetExec (nxc.exe) was used for AD enumeration, credential spraying and remote execution.

Defense evasion used an AV/EDR killer (a.exe) that abuses the vulnerable K7RKScan kernel driver (CVE-2025-1055) in a BYOVD technique, staged from an SMB share and run via net use / copy / start /B. On 2026-07-31 Warlock (run.exe / rune.exe) was staged in the domain SYSVOL scripts share and copied to C:\Users\Public and started on hosts via cmd, with dfsrs.exe confirming SYSVOL replication delivery. In about two hours the killer ran on 40 hosts and Warlock on 33 hosts. No CVSS score is stated in the source.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1505.003 Server Software Component: Web Shell
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1574.001 DLL
- T1098.007 Account Manipulation: Additional Local or Domain Groups
- T1685 Disable or Modify Tools
- T1218.007 System Binary Proxy Execution: Msiexec
- T1620 Reflective Code Loading
- T1219.001 Remote Access Tools: IDE Tunneling
- T1087.002 Account Discovery: Domain Account
- T1482 Domain Trust Discovery
- T1110.003 Brute Force: Password Spraying
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1574.002 Hijack Execution Flow: DLL Side-Loading
- T1068 Exploitation for Privilege Escalation
- T1105 Ingress Tool Transfer
- T1570 Lateral Tool Transfer
- T1486 Data Encrypted for Impact
- T1552.004 Unsecured Credentials: Private Keys
- T1543.003 Create or Modify System Process: Windows Service
- T1136.001 Create Account: Local Account
- T1572 Protocol Tunneling
- T1033 System Owner/User Discovery
- T1003.001 OS Credential Dumping: LSASS Memory
- T1484.001 Domain or Tenant Policy Modification: Group Policy Modification

## Sources

- [Warlock Ransomware Attackers Hit Water and Telecom Operators (Symantec Threat Hunter Team)](https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure)
- [MITRE ATT&CK Campaign C0058: SharePoint ToolShell Exploitation](https://attack.mitre.org/campaigns/C0058)
- [Warlock Group: The Rise of GOLD SALEM (Storm-2603) in 2025's Ransomware Landscape (Brandefense)](https://brandefense.io/blog/warlock-group/)
- [Storm-2603 spotted deploying ransomware on exploited SharePoint servers (Help Net Security)](https://www.helpnetsecurity.com/?p=337553)
- [SharePoint Zero-Days Exploited to Unleash Warlock Ransomware (BankInfoSecurity)](https://www.bankinfosecurity.net/sharepoint-zero-days-exploited-to-unleash-warlock-ransomware-a-29073)
- [SharePoint-ageddon attacks riddled with free Warlock ransomware (TechRadar)](https://www.techradar.com/pro/sharepoint-ageddon-attacks-riddled-with-free-warlock-ransomware-and-thousands-of-services-could-be-compromised)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2833