A China-based group that deploys Warlock ransomware has broken into a water utility, a telecommunications provider, a regional government body and a university by exploiting on-premises Microsoft SharePoint servers, SecurityWeek reported Friday. The findings come from Symantec's Threat Hunter Team, which said all four victims were in Portuguese- or Spanish-speaking countries in Europe, Africa and Latin America.

What Happened

Symantec, working with Carbon Black, tracks the operators as Longlegs. Microsoft calls the same group Storm-2603, and researchers have linked it to activity tracked as CL-CRI-1040, CamoFei and ChamelGang. Symantec's report, dated Oct. 1, covers attacks over roughly the previous two months.

Initial access came through several SharePoint vulnerabilities. They include the 2025 ToolShell chain (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771) and newer SharePoint flaws that the U.S. Cybersecurity and Infrastructure Security Agency warned about in July. SecurityWeek listed six 2026 CVEs among the bugs in play.

RelatedU.S. Seizes Integrity Tech Hacking Tool Sites as Seven Nations Detail Flax Typhoon Ops

Symantec laid out the timeline of one intrusion at a critical infrastructure operator. Attackers used PowerShell to plant a webshell on a SharePoint server July 22, ran reconnaissance commands July 24 and tested an outbound connection to a Burp Collaborator server July 27. Over July 28 and 29 they escalated to a domain account. Early on July 31 they pushed a tool that disables antivirus and endpoint detection software to more than 40 hosts in about two hours, then deployed Warlock on at least 33.

To kill security products, the group used a bring-your-own-vulnerable-driver technique built on a signed K7RKScan driver with a known flaw, CVE-2025-1055. It staged the ransomware in the domain's SYSVOL share so that Windows replication spread it, used NetExec for Active Directory enumeration and credential spraying, sideloaded malicious DLLs and pulled files from catbox[.]moe and wasabisys[.]com. A Visual Studio Code tunnel gave the attackers persistent remote access.

Why It Matters

Water and telecom operators run services that people depend on daily, and ransomware that encrypts dozens of servers can disrupt operations even when control systems are separate from office networks. The Record noted that the inclusion of critical infrastructure among the victims underlines the real-world stakes of these attacks.

The campaign also shows how long SharePoint exposure lingers. ToolShell was disclosed and patched in July 2025, yet Symantec said exploitation of it and related bugs remains a workable way in. Organizations that still run SharePoint on their own servers and have not applied both the 2025 and 2026 fixes are exposed to a group with a record of fast, destructive follow-through.

A State-Linked Ransomware Actor

Storm-2603 drew attention in mid-2025, when Microsoft reported it exploiting ToolShell alongside the Chinese state groups Linen Typhoon and Violet Typhoon. That campaign reportedly breached at least 400 governments and companies, including U.S. federal agencies. Earlier Warlock victims were spread across the U.S., Russia, Brazil, India, Taiwan and Japan.

Symantec said the new concentration in Portuguese- and Spanish-speaking countries stands out. It offered two explanations without choosing between them: opportunistic targeting driven by which SharePoint servers were exposed and vulnerable, or deliberate tasking.

What to Watch

Defenders should look for the indicators Symantec published, including the vulnerable K7 driver, unexpected VS Code tunnels and unusual files in SYSVOL. It remains to be seen whether CISA or partner agencies issue water-sector guidance tied to the campaign, and whether utilities in Latin America or the Iberian Peninsula disclose incidents.