[CLSTR]
API
< Back to all clusters
[TECHNOLOGY] · 4 sources

started · updated

Part of situation: Longlegs ransomware attacks on critical infrastructure (2 clusters)

Longlegs ransomware group targets critical infrastructure via SharePoint flaws

Warlock ransomware Longlegs SharePoint vulnerabilities critical infrastructure attacks cybersecurity

A China-nexus threat actor, tracked by Symantec as Longlegs (also known as Storm-2603), continues to deploy Warlock ransomware by exploiting vulnerabilities in on-premises Microsoft SharePoint Server. Over the last two months, the group has targeted at least four organizations across Europe, Africa, and Latin America, specifically focusing on Portuguese- and Spanish-speaking regions.

The victims include a water utility, a telecommunications provider, a regional government body, and a university. In one instance involving a critical infrastructure operator, the attackers used a tool to disable security software on at least 40 hosts within two hours before deploying Warlock ransomware on 33 hosts via the domain’s SYSVOL share.

Longlegs gained prominence in June 2025 by exploiting a chain of zero-day vulnerabilities in SharePoint dubbed ‘ToolShell’. The group also utilizes legitimate tools, DLL sideloading, and Visual Studio Code’s tunneling feature for remote access and to evade detection.

Entities

CISA · Longlegs · Microsoft SharePoint Server · Symantec

Sources

Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware [cybernoz.com]
Warlock und SharePoint-Lücken: Security-Tools aushebeln und Ransomware streuen [www.it-boltwise.de]
Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks | #ransomware | #cybercrime - National Cyber Security Consulting [nationalcybersecurity.com]
Warlock Ransomware Attackers Hit Water and Telecom Operators [www.security.com]