Warlock ransomware exploits SharePoint flaws to hit critical infrastructure

The Warlock ransomware group, tracked by Symantec as Longlegs (also known as Storm-2603), continues to target critical infrastructure by exploiting unpatched Microsoft SharePoint vulnerabilities. The group has recently breached water utilities, telecommunications providers, government bodies, and universities across Europe, Africa, and Latin America.

Attackers utilize a chain of vulnerabilities, including CVE-2023-29357 for unauthenticated remote code execution and CVE-2022-24521 for privilege escalation. Once access is gained, the group deploys webshells for persistence and uses techniques like DLL sideloading and living-off-the-land binaries to move laterally through networks.

The ransomware employs AES-256 and RSA-4096 hybrid encryption, often using intermittent encryption to evade detection. The group practices double extortion by exfiltrating sensitive data to leak sites. While recent activity has focused on Portuguese- and Spanish-speaking regions, the group has previously targeted organizations in the US, Brazil, India, Russia, Taiwan, and Japan.