The China-linked group behind Warlock ransomware is breaking into on-premises SharePoint servers to attack critical infrastructure, researchers say. Symantec and Carbon Black’s Threat Hunter Team reported on October 2 that the actor, tracked as Longlegs and by Microsoft as Storm-2603, hit at least four organisations in the past two months.

The victims include a water utility, a telecom provider, a regional government body and a university. They are located in Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America, according to The Hacker News.

The group exploits SharePoint flaws, including the ToolShell chain and a newer 2026 vulnerability that CISA has added to its exploited list. In one intrusion, attackers disabled security tools on at least 40 hosts within two hours and deployed ransomware on at least 33 machines. They used Visual Studio Code tunnels for remote access and staged payloads in the domain’s SYSVOL share.

Researchers warn that patching SharePoint is not enough on its own. Stolen ASP.NET machine keys can survive an update, so Microsoft, CISA and the UK’s NCSC all advise rotating keys and hunting for leftover shells first.