Longlegs ransomware attacks on critical infrastructure

The China-nexus threat actor known as Longlegs (or Storm-2603) has been deploying Warlock ransomware by exploiting vulnerabilities in on-premises Microsoft SharePoint Server. The group gained prominence in June 2025 through the exploitation of zero-day vulnerabilities dubbed ‘ToolShell’.

Recent activity shows the group targeting critical infrastructure, including water utilities, telecommunications providers, government bodies, and universities across Europe, Africa, and Latin America, with a specific focus on Portuguese- and Spanish-speaking regions. In one recorded instance, attackers disabled security software on at least 40 hosts within two hours before deploying ransomware via a domain’s SYSVOL share.

Technically, the group utilizes a chain of vulnerabilities, such as CVE-2023-29357 for unauthenticated remote code execution and CVE-2022-24521 for privilege escalation. To maintain access and evade detection, Longlegs employs webshells, DLL sideloading, and living-off-the-land binaries. The Warlock ransomware uses AES-256 and RSA-4096 hybrid encryption, often utilizing intermittent encryption. The group also engages in double extortion by exfiltrating sensitive data to leak sites. While recent targets are concentrated in specific linguistic regions, the group has previously operated in the US, Brazil, India, Russia, Taiwan, and Japan.