---
title: China-Linked Warlock Ransomware Still Breaking Into Utilities
description: Warlock ransomware group exploits SharePoint flaws to attack critical infrastructure in Portuguese and Spanish-speaking regions.
canonical_url: https://codekeeper.co/ticker/warlock-ransomware-sharepoint-attacks
---

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks)

# China-Linked Warlock Ransomware Still Breaking Into Utilities

Warlock ransomware group exploits SharePoint flaws to attack critical infrastructure in Portuguese and Spanish-speaking regions.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Oct 5, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwarlock-ransomware-sharepoint-attacks%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwarlock-ransomware-sharepoint-attacks%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwarlock-ransomware-sharepoint-attacks%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwarlock-ransomware-sharepoint-attacks%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwarlock-ransomware-sharepoint-attacks%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwarlock-ransomware-sharepoint-attacks%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Symantec reports that the China-nexus group behind Warlock ransomware is still breaking into organizations through Microsoft SharePoint, a year after that route made its name. The group goes by Longlegs at Symantec and Storm-2603 at Microsoft. In the two months to October 1, it hit at least four organizations across Europe, Africa, and Latin America: a water utility, a telecom provider, a regional government body, and a university. In one intrusion against a critical infrastructure operator, the attackers pushed an AV and EDR killing tool to at least 40 hosts inside about two hours, then ran Warlock on at least 33 of them. They staged the payload in the domain's SYSVOL share, so routine domain replication carried it everywhere at once. The way in is on-premises SharePoint Server, not the cloud version. Once inside, the group plants a webshell and steals the farm's ASP.NET machine keys, then uses them to forge a signed payload. That changes what cleanup means: patching alone leaves stolen keys valid, so they have to be rotated too. Security tools go down via a signed but vulnerable driver — K7RKScan in other recent Longlegs intrusions, unidentified in this one. For remote access the group installs Visual Studio Code's tunnel service, so the traffic reads like a developer's. Unpatched SharePoint servers remain the primary entry point. A year on, that still works. **Source:** [SecurityWeek](https://www.securityweek.com/warlock-expands-sharepoint-exploitation-in-critical-infrastructure-attacks/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwarlock-ransomware-sharepoint-attacks%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwarlock-ransomware-sharepoint-attacks%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwarlock-ransomware-sharepoint-attacks%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwarlock-ransomware-sharepoint-attacks%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwarlock-ransomware-sharepoint-attacks%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwarlock-ransomware-sharepoint-attacks%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Software security Critical GitLab AI Gateway Flaw Allows Remote Code Execution Oct 5, 2026](https://codekeeper.co/ticker/gitlab-ai-gateway-security-update)

[Cyberattacks Claude AI Used to Run Nearly Every Stage of a Live Ransomware Campaign Aug 20, 2026](https://codekeeper.co/ticker/ai-driven-ransomware-attacks-gambit-security-report)

[Cyberattacks AI-Powered Attacks Are Actively Targeting U.S. Critical Infrastructure, Agencies Warn Aug 20, 2026](https://codekeeper.co/ticker/ai-scripts-threaten-critical-infrastructure)

[Cyberattacks ASOS App Hijacked by Hackers to Send Extortion Message Oct 7, 2026](https://codekeeper.co/ticker/asos-cyberattack-xuanye-group-threat)