Here is a hypothetical that will sound familiar to anyone who has sat through a cloud migration kickoff. The on-prem SharePoint farm is “being retired.” It has been being retired for two years. Patching it slips to “after the cutover,” monitoring quietly lapses, and the box keeps answering on port 443 the whole time. That server is exactly the kind of thing the Warlock ransomware crew is still breaking into, according to new research. It is getting in through SharePoint vulnerabilities, some of which have had a patch available for more than a year.
The source here is the Symantec and Carbon Black Threat Hunter Team’s October 1 report on Warlock. It describes a group Symantec calls Longlegs, which Microsoft tracks as Storm-2603, hitting critical infrastructure through on-premises SharePoint. Here is what the report actually says, where the sheet headline went a little too far, and what I would check this week.
Who Got Hit, and What Symantec Actually Says
Symantec says that in the past two months Longlegs attacked at least four organizations. Two were critical infrastructure operators, a water utility and a telecommunications provider. The other two were a regional government body and a university. All four were in Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America. Symantec does not name the victims, and the report does not describe any disruption to water treatment or network operations. I am not going to imply either. The report calls the group China-nexus. It notes that Warlock has previously turned up in a wider range of countries, including the United States, but none of these four were US organizations.
This is not the group’s first SharePoint campaign. Warlock emerged in June 2025 and became notorious weeks later, when it was tied to the “ToolShell” zero-days in on-prem SharePoint Server. In its July 2025 write-up, Microsoft said it had observed Storm-2603 exploiting those flaws to deploy ransomware. Microsoft released security updates for all supported SharePoint Server versions that month.
Which SharePoint Vulnerabilities, and Which Patch
The sheet headline said “year-old flaws.” That is only partly right, and the distinction matters for what you patch:
- The 2025 ToolShell chain (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771). Symantec says these “likely remain in the group’s arsenal.” Note the word likely.
- Newer SharePoint flaws. Symantec points to the ones covered in a July 2026 CISA advisory. CISA’s SharePoint hardening alert lists six actively exploited 2026 CVEs affecting all supported on-prem versions: Subscription Edition, 2019 and 2016. CISA added them to its Known Exploited Vulnerabilities catalog between April and August 2026.
Symantec does not pin each intrusion to a single CVE. For the attack it walks through in detail, it says initial access was “likely” through SharePoint Server vulnerabilities. So the honest framing is “old and newer SharePoint flaws on servers that were not patched or otherwise mitigated,” not “a year-old bug did it.”
Inside One Intrusion: Nine Days From Webshell to Ransomware
Symantec’s detailed case is one intrusion at a critical infrastructure operator. The report does not say whether it was the water utility or the telecom. The timeline is worth reading slowly:
- July 22, 2026: A webshell landed in the SharePoint LAYOUTS directory. Symantec says the group drops it for several SharePoint versions at once, and uses it to harvest the farm’s ASP.NET machine keys. With those keys it can forge validly signed payloads and run code inside the SharePoint application pool.
- July 24 to 29: Reconnaissance, DLL sideloading and payloads pulled from public file-hosting services. The attackers added a domain account to local Administrators on three more hosts. Symantec says its name was likely chosen to pass for a SharePoint setup account. They installed a Visual Studio Code tunnel as a service for covert remote access and ran NetExec for Active Directory enumeration and credential spraying.
- July 31: An AV/EDR killer was pushed to at least 40 hosts within about two hours. Warlock showed up on at least 33 hosts almost as soon as protection dropped on each one. The payload was staged in the domain’s SYSVOL share, and on three hosts telemetry showed ordinary SYSVOL replication delivering it.
That is nine days from first observed activity to ransomware. It is not a smash-and-grab either. In my view, that is plenty of time for someone watching the right logs to notice.
One correction to a common shorthand. Symantec says Longlegs abuses a signed but vulnerable K7RKScan driver (CVE-2025-1055) to kill security tools, and BleepingComputer’s coverage repeats that. But in this specific intrusion, Symantec says the identity of the vulnerable driver “remains unknown.” K7RKScan is what the group used in other recent attacks.
Opinion: Patch Debt Is the Real Playbook
This section is my opinion, not Symantec’s finding. Nothing in this report needed a fresh zero-day to be scary. What made it work, as far as the public details go, is the stuff every ops team recognizes: an internet-facing on-prem server that probably was not first in line for patches, a farm whose machine keys a webshell could simply read, and a domain where a new executable in SYSVOL does not set off alarms. I call that patch debt. Like financial debt, the interest compounds quietly until someone else collects it.
Water utilities and telecoms are not uniquely careless. They tend to run long-lived systems with tight change windows, which is precisely the environment where “we’ll patch it after the migration” turns into a two-year habit.
What I Would Check This Week
- Find every on-prem SharePoint server, including the one “being retired,” and confirm the latest Microsoft updates are actually installed, not just approved.
- Get it off the open internet. CISA’s first recommendation is to avoid exposing SharePoint directly. If you must expose it, put it behind an application-layer proxy that enforces authentication.
- Hunt before you rotate. CISA says to look for machine-key harvesters and other intrusion artifacts before rotating IIS machine keys. Otherwise you are just handing the attacker fresh keys.
- Turn on AMSI integration for each SharePoint web application, as CISA recommends.
- Watch SYSVOL like it is production code. New executables under the scripts folder deserve an alert, and so does a VS Code tunnel service showing up on a server.
None of that is exotic. It is the backlog. Warlock is betting you will not get to it.