Security2 hOctober 4, 2026, 14:49

Warlock ransomware still exploits year-old SharePoint flaws

Symantec links the Longlegs group (Storm-2603) behind Warlock ransomware to attacks on water utilities, telecoms, governments and universities via unpatched SharePoint ToolShell flaws. At least four organizations in Portuguese- and Spanish-speaking countries were hit in two months.

Security Affairs

Open source

Warlock ransomware still exploits year-old SharePoint flaws

Four victims in two months: water utility, telecom, government, university
Attackers drop a webshell in LAYOUTS and steal ASP.NET machine keys
They disable security software using vulnerable driver K7RKScan
In one intrusion Warlock hit 33 hosts via SYSVOL within two hours

#Symantec#SharePoint#Microsoft

Warlock ransomware spread via SYSVOL after SharePoint compromise

Security

CISA: ransomware gangs now exploiting critical TeamCity flaw

Security

Warlock Ransomware Hits Major Spanish, Portuguese Organizations

Security

Warlock ransomware still exploits year-old SharePoint flaws

Warlock ransomware spread via SYSVOL after SharePoint compromise

CISA: ransomware gangs now exploiting critical TeamCity flaw

Warlock Ransomware Hits Major Spanish, Portuguese Organizations

16-year-old suspected leader of KillSec ransomware group arrested