Summary
- Warlock operators targeted four organisations after exploiting vulnerabilities in on premises SharePoint servers.
- Victims included a water utility, telecommunications provider, regional government body, and university.
- The findings add ransomware and essential service impact to previously documented SharePoint exploitation.
Researchers tracking Warlock ransomware have linked continuing Microsoft SharePoint exploitation to attacks against a water utility, telecommunications provider, regional government body, and university across Europe, Africa, and Latin America.
During the past two months, the actor appears to have concentrated on Portuguese and Spanish speaking countries, with SharePoint vulnerabilities providing initial access before attackers moved further into victim environments. The campaign is associated by researchers with the operation also tracked as Longlegs.
Cyber Insider reported in September on continuing exploitation of a SharePoint vulnerability patched by Microsoft in August, while the latest research adds evidence of how compromise can progress into ransomware attacks against organisations delivering public and essential services.
During one documented intrusion, attackers disabled endpoint protection across more than 40 hosts within roughly two hours before Warlock ransomware was deployed to 33 systems. Although individual victims have not been named publicly, the affected sectors show the campaign reaching infrastructure where disruption can have consequences beyond ordinary corporate IT.
SharePoint provided the initial route into wider networks
Where on premises SharePoint servers connect with identity services, documents, administrative functions, and other internal resources, exploitation at the web application layer can provide a starting point for credential collection and movement through the wider environment.
Warlock gained wider attention in 2025 after operators exploited the collection of SharePoint vulnerabilities known as ToolShell, while Microsoft also observed state backed groups using the same weaknesses. Researchers now say Warlock has continued to use SharePoint vulnerabilities rather than abandoning the platform after the original disclosure cycle.
That persistence is significant for organisations running exposed servers because a patch becoming available does not remove access an attacker already obtained, nor does publication of a vulnerability immediately eliminate unpatched systems from the internet. Investigations therefore have to consider both current exposure and evidence that a server may have been compromised earlier.
Water and telecommunications organisations introduce an operational dimension because their networks support services used outside the breached organisation itself, while universities and regional government bodies combine large user populations with extensive internal systems and data.
Researchers describe Warlock as China linked, but that assessment should remain distinct from the confirmed mechanics of each individual intrusion. Public evidence establishes SharePoint exploitation and subsequent ransomware activity in observed cases without independently proving the identity or sponsorship of every operator involved.
