Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks
The China-based hacking group known as Warlock, linked to Longlegs and Storm-2603, has been exploiting SharePoint vulnerabilities since July 2025 to target critical infrastructure, government, education, and telecom entities globally. Their attacks leverage multiple SharePoint flaws including ToolShell zero-days and recent CVEs such as CVE-2026-32201 and others. The group employs advanced techniques including webshell deployment, ASP.NET machine key exfiltration, DLL sideloading, and disabling security software to execute ransomware at scale. They also abuse Visual Studio Code's tunnel feature for covert network access and stage ransomware payloads in SYSVOL shares for domain-wide impact. These activities demonstrate that unpatched or unmitigated SharePoint vulnerabilities remain a significant attack vector for ransomware campaigns.
AI Analysis
Technical Summary
Warlock, operated by the China-based groups Longlegs and Storm-2603, has exploited SharePoint vulnerabilities since mid-2025, including zero-day ToolShell flaws and multiple recent CVEs (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, CVE-2026-50522, CVE-2026-55040). Their attacks target critical infrastructure, government, education, and telecom sectors worldwide. The exploitation chain involves webshell deployment, exfiltration of ASP.NET machine keys, forced signed payloads for remote code execution, DLL sideloading, and disabling security tools via vulnerable drivers. They also use living-off-the-land tools and abuse Visual Studio Code's tunnel feature for stealthy remote access. Ransomware payloads are staged in SYSVOL shares to propagate across domain controllers. The group’s continued activity highlights the ongoing risk posed by unpatched SharePoint deployments.
Potential Impact
The exploitation of SharePoint vulnerabilities by Warlock enables initial access and lateral movement within targeted networks, leading to deployment of ransomware that encrypts files at scale across domain controllers. The attacks have impacted critical infrastructure operators, government bodies, universities, and telecom providers across multiple regions. The group’s ability to disable security software and establish covert remote access increases the difficulty of detection and remediation. This results in significant operational disruption and potential data loss for affected organizations.
Mitigation Recommendations
No official patch or remediation status is provided in the available data. Organizations using SharePoint should verify they have applied all relevant security updates addressing the referenced CVEs and ToolShell vulnerabilities. Given the threat actor’s tactics, monitoring for webshells, suspicious DLL sideloading, and unusual use of Visual Studio Code tunnels is advised. Security software should be hardened against tampering. Since patch status is not confirmed, check vendor advisories for current guidance and apply patches promptly when available.
Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks
Description
The China-based hacking group known as Warlock, linked to Longlegs and Storm-2603, has been exploiting SharePoint vulnerabilities since July 2025 to target critical infrastructure, government, education, and telecom entities globally. Their attacks leverage multiple SharePoint flaws including ToolShell zero-days and recent CVEs such as CVE-2026-32201 and others. The group employs advanced techniques including webshell deployment, ASP.NET machine key exfiltration, DLL sideloading, and disabling security software to execute ransomware at scale. They also abuse Visual Studio Code's tunnel feature for covert network access and stage ransomware payloads in SYSVOL shares for domain-wide impact. These activities demonstrate that unpatched or unmitigated SharePoint vulnerabilities remain a significant attack vector for ransomware campaigns.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Warlock, operated by the China-based groups Longlegs and Storm-2603, has exploited SharePoint vulnerabilities since mid-2025, including zero-day ToolShell flaws and multiple recent CVEs (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, CVE-2026-50522, CVE-2026-55040). Their attacks target critical infrastructure, government, education, and telecom sectors worldwide. The exploitation chain involves webshell deployment, exfiltration of ASP.NET machine keys, forced signed payloads for remote code execution, DLL sideloading, and disabling security tools via vulnerable drivers. They also use living-off-the-land tools and abuse Visual Studio Code's tunnel feature for stealthy remote access. Ransomware payloads are staged in SYSVOL shares to propagate across domain controllers. The group’s continued activity highlights the ongoing risk posed by unpatched SharePoint deployments.
Potential Impact
The exploitation of SharePoint vulnerabilities by Warlock enables initial access and lateral movement within targeted networks, leading to deployment of ransomware that encrypts files at scale across domain controllers. The attacks have impacted critical infrastructure operators, government bodies, universities, and telecom providers across multiple regions. The group’s ability to disable security software and establish covert remote access increases the difficulty of detection and remediation. This results in significant operational disruption and potential data loss for affected organizations.
Defensive Guidance
No official patch or remediation status is provided in the available data. Organizations using SharePoint should verify they have applied all relevant security updates addressing the referenced CVEs and ToolShell vulnerabilities. Given the threat actor’s tactics, monitoring for webshells, suspicious DLL sideloading, and unusual use of Visual Studio Code tunnels is advised. Security software should be hardened against tampering. Since patch status is not confirmed, check vendor advisories for current guidance and apply patches promptly when available.
Technical Details
- Classification
- {"confidence":0.64,"severitySource":"heuristic","classifier":"rss-v2"}
- Article Source
- {"url":"https://www.securityweek.com/warlock-expands-sharepoint-exploitation-in-critical-infrastructure-attacks/","fetched":true,"fetchedAt":"2026-10-02T09:46:09.504Z","wordCount":1123}
Threat ID: 6abf7d61a43b0b3b899e5b8e
Added to database: 10/02/2026, 09:46:09 UTC
Last enriched: 10/02/2026, 09:46:16 UTC
Last updated: 10/03/2026, 01:06:27 UTC
Views: 21
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.