Warlock Ransomware Is Still Breaking Into SharePoint Servers Through a 15-Month-Old Bug

A China-linked ransomware operation is still breaching organizations through a Microsoft SharePoint flaw chain that was disclosed and patched fifteen months ago. Symantec's threat intelligence unit published a report on October 1, 2026, later corroborated by BleepingComputer, stating that the group tracked as Warlock, also known as Longlegs, Gold Salem, and Microsoft's designation Storm-2603, compromised at least four organizations in the two months leading up to October: a water utility, a telecommunications provider, a regional government body, and a university.

The victims were concentrated in Portuguese- and Spanish-speaking countries across Europe, Africa, and Latin America, according to reporting from The Hacker News citing researchers at Symantec and the Carbon Black Threat Hunter Team. None of the organizations were named. The reporting describes confirmed cases, not a complete global victim count, so the true scope of the campaign may be larger than the four organizations disclosed.

The campaign surfaced in the same week that Comparitech published its Q3 2026 ransomware tracker, which counted 2,627 claimed ransomware attacks globally, the highest quarterly total the firm has recorded. Comparitech notes that fewer than one in ten victims publicly confirms an attack, meaning the real figure is almost certainly higher. Warlock's four confirmed victims are a small slice of that total, but the choice of water utilities and telecom operators puts the campaign in national-security territory regardless of the raw count.

How nine days turned a server flaw into a network-wide ransom

One intrusion, documented in detail by Symantec researchers, shows how methodical the operation has become. The attackers established initial access through an on-premises SharePoint Server and, by one industry summary of the BleepingComputer reporting, spent nine days moving through the victim's network before triggering encryption across it.

In that intrusion, the group pushed a tool designed to disable endpoint detection and response software to at least 40 hosts within about two hours, then deployed the Warlock payload on at least 33 hosts. Symantec's researchers described the sequence plainly: the EDR-killing step neutralized traditional endpoint defenses first, and the encryption stage followed only after that safety net was gone.

SYSVOL, a vulnerable driver, and the abuse of trusted tools

The most unusual tactic in the documented intrusions was how the ransomware was distributed. Rather than spreading machine by machine, the attackers staged the Warlock binary directly in the target domain's SYSVOL share, the Windows folder that domain controllers use to distribute Group Policy. Ordinary Distributed File System Replication then carried the payload to every domain controller, from where it could reach member hosts. Researchers observed the ransomware on at least 33 machines through this replication path alone.

To disable security software, the group used a bring-your-own-vulnerable-driver attack, loading a legitimately signed but vulnerable driver, tracked as K7RKScan, to strip endpoint protections from beneath the operating system. Execution relied on DLL sideloading, and the group maintained remote access through tunnels built into Visual Studio Code's remote development feature, a legitimate tool whose traffic blends into normal administrator activity. Legitimate remote-management software, Velociraptor, was also used for command and control, according to The Hacker News.

The entry point was a vulnerability patched fifteen months ago. The damage came from everything the attackers did after walking through it.

Why a patched bug chain keeps producing fresh victims

ToolShell is the name researchers gave to four chained SharePoint flaws. Microsoft disclosed the first pair, a remote code execution flaw tracked as CVE-2025-49704 and a spoofing flaw tracked as CVE-2025-49706, on July 8, 2025. When attackers found a way around those fixes, Microsoft issued emergency patches for CVE-2025-53770 and CVE-2025-53771 on July 19 and July 22, 2025. The chain affects on-premises SharePoint Server 2016, 2019, and the Subscription Edition. SharePoint Online, Microsoft's cloud-hosted version, is not affected.

There is a technical reason the chain has stayed useful long after disclosure. Successful exploitation can let an attacker extract the server's cryptographic machine keys, which can then be used to forge trusted requests even after the server is patched, unless administrators also rotate those keys and restart the affected services. Trellix's technical analysis of ToolShell flagged key rotation as a mandatory recovery step, not optional hardening. Organizations that installed the July 2025 patches and moved on, particularly those that applied the original July 8 pair but never applied the emergency follow-up fixes, may have believed they were protected while remaining exposed.

Some reporting points to an additional entry point beyond ToolShell. An October 3 industry summary notes a newer SharePoint flaw, CVE-2026-45659, now listed in CISA's Known Exploited Vulnerabilities catalog, as possibly in use in the same campaign. The primary Symantec reporting does not confirm this, so it should be treated as an open line of reporting rather than an established fact.

What SharePoint administrators should check this week

Security teams circulating guidance this month are framing the Warlock report as a prompt to re-verify 2025 remediation rather than as a new patching emergency. The checklist covers four steps: confirm that all four CVEs in the ToolShell chain have corresponding security updates installed, not only the original July 8 pair; rotate the ASP.NET machine keys on every SharePoint farm, since stolen keys remain valid independently of patch status; restart IIS and related services so the new keys take effect; and review IIS logs for anomalous child processes spawned by the SharePoint application pool's worker process, the forensic signature most associated with ToolShell exploitation.

Beyond patching, the campaign argues for defenses that assume a foothold will happen. That means restricting which signed drivers are allowed to load, limiting write access to the SYSVOL share to what the domain actually needs, auditing remote-access tunnels such as those built into Visual Studio Code, and alerting on the mass disabling of endpoint agents, which in the documented intrusion preceded encryption by only a short window.