Warlock Returns to Exploit Unpatched SharePoint, Targets Portuguese and Spanish-Speaking Countries

The group behind the Warlock ransomware has returned to exploiting unpatched Microsoft SharePoint servers and has begun targeting organizations in Portuguese and Spanish-speaking countries, according to a report by Symantec and Carbon Black's Threat Hunter team released in early October 2026. In two months, the group attacked at least four organizations: a water company, a telecommunications operator, a regional government agency, and a university, across Europe, Africa, and Latin America.

What is known

item	detail
Group	Longlegs for Symantec, Storm-2603 for Microsoft; associated with older Chinese-origin clusters such as CL-CRI-1040, CamoFei, and ChamelGang
Recent Victims	at least four: water company, telecommunications operator, regional government, and university
Countries	reports do not name specific countries; mention Portuguese and Spanish-speaking countries in Europe, Africa, and Latin America
Initial Access	on-premises SharePoint Server vulnerabilities, with webshell installed in the LAYOUTS directory
Cited Vulnerabilities	ToolShell chain from 2025 (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771, according to BleepingComputer); SecurityWeek also lists six CVEs from 2026
Official Alert	CISA published an alert on July 14, 2026, regarding new SharePoint exploits, according to The Record

Symantec describes an intrusion that began on July 22 against a critical infrastructure operator. The attackers stole ASP.NET machine keys to forge signed payloads and execute code, then disabled security software on at least 40 systems using a vulnerable signed driver (K7RKScan) in a technique known as bring your own vulnerable driver. Warlock was executed on at least 33 systems. The ransomware file was stored in the SYSVOL share, replicated to all domain controllers, and delivered by the Windows replication service itself, allowing encryption at scale without an external distribution tool.

Other report details: a domain account with a name mimicking SharePoint (SPSEPRDSetup) was created and placed in local administrator groups; and the Visual Studio Code tunnel (code-insiders.exe) was installed as a service for discreet remote access.

Symantec states that it cannot determine if the group still relies solely on ToolShell or also exploits newer vulnerabilities. According to researchers, the focus on Portuguese and Spanish-speaking countries could be opportunistic, guided by exposed and vulnerable servers, or the result of a target list.

Why it matters for financial institutions

Brazil does not appear as a victim in this campaign, but it had previously been among the countries affected by earlier Warlock attacks, according to The Record and Security Affairs. What makes the case relevant is the path: on-premises SharePoint is common in financial institutions and public bodies, is often exposed for access by partners and branches, and once compromised, leads to the entire domain.

The most important detail is that the attack succeeds where there is delayed patching, not where there is a new vulnerability. The ToolShell vulnerabilities are from 2025. The question the audit will ask is not whether the institution patched SharePoint, but whether someone verified, after patching, that the server was not compromised before it.

What to do now

1. Inventory all on-premises SharePoint servers and which ones are accessible via the internet. In cloud environments (SharePoint Online), the described campaign does not apply.
2. Review the CISA alert from July 2026 and apply patches and mitigations, including those for the ToolShell chain from 2025.
3. Rotate the ASP.NET machine keys of the server and restart the service after patching. The attack steals these keys, and patching alone does not invalidate already stolen keys. This is a recommendation from Indene based on the report; confirm the procedure in Microsoft's guide.
4. Look for signs of compromise: new files in the SharePoint LAYOUTS directory, the SPSEPRDSetup account, the code-insiders.exe service, strange files in SYSVOL, and the K7RKScan driver.
5. Enable EDR tamper protection and block known vulnerable drivers to hinder the step that disables defenses.
6. Record the verification, with date and responsible party, as evidence.

---

References

• Warlock ransomware breaches SharePoint in water, telecom operator attacks: BleepingComputer, October 2, 2026
• Warlock ransomware used in critical infrastructure attacks: The Record, October 2, 2026
• Warlock expands SharePoint exploitation in critical infrastructure attacks: SecurityWeek, October 2, 2026
• Warlock Ransomware Still Exploits Year-Old SharePoint Flaws to Hit Critical Infrastructure: Security Affairs, October 4, 2026