A ransomware group known as Warlock has broken into a water utility, a telecommunications provider, a regional government office and a university by exploiting Microsoft SharePoint vulnerabilities that were first disclosed and patched more than a year ago. The intrusions, detailed in new research from Symantec and the Carbon Black Threat Hunter Team at Broadcom, show that organizations still running unpatched on-premises SharePoint servers remain exposed to a well-documented and widely publicized attack chain.
The affected organizations were not named. Symantec and Carbon Black described the victims only as being located in Portuguese- and Spanish-speaking countries spread across Europe, Africa and Latin America.
A familiar vulnerability, reused for over a year
The entry point in these attacks is a set of SharePoint flaws collectively nicknamed ToolShell, made up of CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771. Microsoft disclosed and patched these bugs in July 2025 after they were found being exploited against on-premises SharePoint Server deployments. Chained together, they let an attacker who can reach a vulnerable SharePoint server run code on it without needing valid credentials.
ToolShell did not stay a one-time event. Within weeks of its disclosure in 2025, Microsoft said it had observed Chinese state-linked hacking groups it tracks as Linen Typhoon and Violet Typhoon using the same exploit chain. Warlock, the ransomware operation behind the newly documented intrusions, is suspected by researchers to have ties to China as well, and Microsoft tracks the group internally as Storm-2603. Symantec and Carbon Black refer to the same actor as Longlegs, and the ransomware itself has also circulated under the name Gold Salem in earlier reporting. Warlock first drew attention from security researchers in mid-2025, not long after the SharePoint flaws became public.
How one intrusion played out
Symantec and Carbon Black walked through one documented case in detail. The attackers gained initial access on July 22, 2026, through a vulnerable SharePoint server, then dropped a web shell to maintain a foothold. From there, they collected the SharePoint farm’s ASP.NET machine keys, which let them forge valid-looking requests and achieve code execution inside the SharePoint application pool even after the initial exploit window closed.
Over the following days the group carried out reconnaissance using the network scanning tool NetExec and installed Visual Studio Code Insiders as a background service, which gave them a quiet remote access channel into the network. On July 24, they worked to clean up some of their earlier tracks. To clear the way for ransomware, the attackers used a bring-your-own-vulnerable-driver technique, loading a legitimately signed but flawed driver called K7RKScan.sys, tracked as CVE-2025-1055, to shut down antivirus and endpoint detection tools on roughly 40 machines. According to the researchers, the ransomware payload began landing on each host almost as soon as its security software was disabled.
For distribution, the attackers staged the Warlock ransomware binary inside the domain’s SYSVOL share, a folder that Windows domain controllers normally use to push out group policy settings to every computer on the network. By riding along with that legitimate replication mechanism, they were able to deploy the ransomware across at least 33 hosts in a short window, with full encryption completed by July 31, 2026.
Why this keeps happening
None of the vulnerabilities used in this campaign are new, and no fresh CVE has been assigned to this specific activity. That is precisely the point researchers are making: patches for ToolShell have existed since July 2025, yet more than a year later, internet-facing SharePoint servers that have not been updated continue to give ransomware groups an easy way in. Symantec and Carbon Black noted that ToolShell remains a viable initial access route for attackers for exactly this reason.
This is not the first time this site has covered trouble stemming from unpatched SharePoint deployments. In August 2026, we reported on a separate SharePoint authentication bypass, CVE-2026-55040, which attackers were still exploiting weeks after Microsoft had already released a fix. Together, the two incidents point to a recurring pattern: on-premises SharePoint servers are a persistent target, and the gap between a patch becoming available and organizations actually applying it is where attackers continue to operate.
For organizations running on-premises SharePoint Server, the practical takeaway is straightforward. Confirm that the July 2025 ToolShell patches are installed, rotate ASP.NET machine keys if there is any chance a server was exposed before patching, and keep an eye out for unexpected scheduled tasks, unfamiliar services, or signed drivers that have no business being on a server, since BYOVD techniques rely on exactly that kind of blind spot in endpoint defenses.
Source: This article is based on reporting from BleepingComputer, “Warlock ransomware breach SharePoint in water, telecom operator attacks”, and The Hacker News, both citing research from Symantec and the Carbon Black Threat Hunter Team.
