The China-linked threat actor known as Warlock is continuing to exploit vulnerabilities in Microsoft SharePoint Server, targeting organizations across Portuguese- and Spanish-speaking regions.
Recent attacks have affected organizations across Europe, Africa, and Latin America, including critical infrastructure operators, government bodies, and educational institutions.
The group, also known as Longlegs, Gold Salem, and Storm-2603, has reportedly compromised at least four organizations in recent months. The victims include a water utility, a telecommunications provider, a regional government organization, and a university.
Warlock Expands SharePoint-Based Attacks
Warlock first gained widespread attention in mid-2025 after exploiting the ToolShell vulnerabilities in Microsoft SharePoint to gain access to targeted environments and deploy ransomware.
The threat actor has continued to expand its attack techniques. Earlier this year, the group was linked to the compromise of SmarterTools through an unpatched SmarterMail server.
Warlock has also been observed using legitimate tools such as Velociraptor for command-and-control operations. In addition, the group has used the Bring Your Own Vulnerable Driver (BYOVD) technique to disable security software on compromised systems.
The group’s activity has also shown overlaps with previously identified threat clusters associated with CamoFei, ChamelGang, and CL-CRI-1040.
Security Software Disabled Across Dozens of Systems
In one attack against a critical infrastructure organization, the attackers deployed a tool designed to disable security software on at least 40 hosts within roughly two hours.
The attackers then deployed Warlock ransomware on at least 33 systems.
To distribute the ransomware across the environment, the attackers staged the malicious payload in the organization’s SYSVOL share. Because SYSVOL is routinely replicated across domain controllers, this technique allowed the attackers to distribute the malware across multiple machines.
How Warlock Exploits SharePoint
Warlock’s recent campaigns have relied on multiple vulnerabilities affecting on-premises Microsoft SharePoint Server installations.
After gaining initial access, the attackers have been observed deploying web shells capable of targeting different SharePoint versions.
One major objective is to obtain the SharePoint farm’s ASP.NET machine keys. The attackers can then abuse those keys to forge a validly signed payload and achieve remote code execution within the SharePoint application pool.
This gives the attackers a pathway from an exposed SharePoint server to deeper access within the victim’s network.
Other Techniques Used in the Campaign
The attacks have incorporated several additional techniques:
- DLL sideloading: Malicious code is loaded into memory by abusing legitimate applications and DLL-loading mechanisms.
- Cloud-hosted payloads: Follow-on payloads have been downloaded from legitimate file-sharing and storage services such as Catbox and Wasabi.
- BYOVD attacks: The attackers have abused the vulnerable K7RKScan.sys driver associated with CVE-2025-1055 to disable security software.
- Living-off-the-land techniques: Legitimate operating-system and third-party tools are used for reconnaissance and command execution.
- Visual Studio Code tunnels: The built-in tunnel functionality of Microsoft Visual Studio Code has been abused to establish remote connections to compromised systems.
- SYSVOL-based deployment: Malicious payloads are staged in SYSVOL to facilitate ransomware deployment across large numbers of systems.
Latest Activity Shows the Campaign Is Still Active
The campaign remained active as recently as July 22, 2026.
During a recent intrusion, the attackers reportedly exploited SharePoint vulnerabilities to deploy a web shell, perform network discovery, obtain arbitrary code execution within the SharePoint application pool, deploy additional payloads, move deeper into the network, establish Visual Studio Code tunnels, disable security software, and ultimately deploy ransomware.
The activity shows that Warlock continues to combine SharePoint exploitation with remote access, security-software disruption, and large-scale ransomware deployment.
Portuguese- and Spanish-Speaking Organizations in Focus
The apparent concentration on Portuguese- and Spanish-speaking countries is particularly noteworthy.
The targeting could represent an opportunistic campaign focused on organizations running exposed and vulnerable SharePoint servers. However, it may also indicate more deliberate targeting based on the group’s operational objectives.
Regardless of the motivation, the activity highlights the risks facing organizations that have not patched or otherwise secured internet-facing SharePoint installations.
How Organizations Can Protect Against Warlock
Organizations operating on-premises Microsoft SharePoint should treat externally exposed and unpatched servers as a high-priority security concern.
Security teams should:
- Apply the latest Microsoft security updates and available SharePoint mitigations.
- Review externally accessible SharePoint servers for signs of compromise.
- Monitor for unexpected web shells and suspicious ASP.NET activity.
- Investigate unauthorized access to or changes involving SharePoint machine keys.
- Monitor SYSVOL for unusual executables, scripts, and other recently added files.
- Detect attempts to disable endpoint security products.
- Review vulnerable drivers and investigate potential BYOVD activity.
- Monitor Visual Studio Code tunnels and other unexpected remote-access mechanisms.
- Hunt for suspicious DLL sideloading activity.
- Monitor downloads from cloud-hosted file-sharing services.
- Segment critical systems to reduce the potential impact of ransomware.
Conclusion
Warlock’s continued activity demonstrates how vulnerable internet-facing applications can provide ransomware operators with a powerful entry point into enterprise networks.
The combination of SharePoint exploitation, web shells, machine-key abuse, vulnerable drivers, legitimate administration tools, and SYSVOL-based deployment gives the threat actor multiple ways to establish access and scale attacks.
For organizations still operating vulnerable or unpatched SharePoint Server environments, the message is clear: patching and securing exposed systems should be an immediate priority.
