Symantec and Carbon Black researchers reported on October 1, 2026 that the Warlock ransomware group broke into at least four organizations in two months: a water utility, a telecom provider, a university and a regional government body. The group typically gets in by exploiting on-premises SharePoint Server, not Microsoft 365.
Its known toolkit includes the 2025 “ToolShell” flaws, which Microsoft says affect on-premises SharePoint servers only and not SharePoint Online. The Record reports the 2026 attacks also use newer SharePoint vulnerabilities flagged by US authorities. If you run SharePoint on your own hardware, read on.
| What happened | Warlock ransomware attacks on at least four organizations over two months, typically starting from on-premises SharePoint Server exploitation |
| Who’s affected | Organizations running on-premises SharePoint Server (Subscription Edition, 2019 or 2016) that are not on the current security updates |
| Severity | High: Warlock was deployed on at least 33 hosts in one intrusion |
| Status | Attacks continued in 2026, reportedly using the 2025 ToolShell flaws and newer SharePoint bugs |
| What to do now | Bring SharePoint Server fully up to date, rotate ASP.NET machine keys, and hunt for web shells and unexpected files in SYSVOL |
What happened
Symantec’s report places the victims in Europe, Africa and Latin America, in countries where Portuguese or Spanish is spoken. In one intrusion, a web shell landed on the SharePoint server on July 22, 2026, reconnaissance followed on July 24, and ransomware was deployed on July 31, roughly nine days from first access to encryption.
Symantec links the activity to a group it calls Longlegs, also tracked by Microsoft as Storm-2603, and describes it as China-nexus. Microsoft first reported Storm-2603 deploying Warlock through the ToolShell flaws from July 18, 2025. The Record notes that the group used LockBit ransomware before switching to Warlock.
How the Warlock ransomware attack works
The group’s established entry route is the ToolShell chain (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771), and Symantec expects those flaws to stay in its arsenal alongside newer SharePoint bugs. Per Symantec, the attackers drop a web shell named layout2sp.aspx into SharePoint’s LAYOUTS directory and abuse the server’s ASP.NET machine keys to run code.
From there the playbook is mostly built from legitimate software. The group maps the domain with built-in Windows commands such as whoami and nltest plus the NetExec tool, which BleepingComputer says was also used for credential spraying. It keeps remote access through a Visual Studio Code Insiders tunnel and switches off security software by loading a vulnerable but signed K7RKScan driver (CVE-2025-1055), a technique known as bring-your-own-vulnerable-driver.
The final step is the clever one. The ransomware is staged in the SYSVOL share, which Windows replicates to every domain controller, and is then run across many machines at once. In one case Symantec found Warlock deployed on at least 33 hosts, with the security-tool killer pushed to at least 40.
Why it matters for small businesses
Small businesses that keep their files in SharePoint Online through Microsoft 365 are outside the ToolShell attack path. The exposure sits with firms that run, or inherited, an on-premises SharePoint Server for an intranet or document system and patch it irregularly.
The techniques after entry are not limited to big targets. Once attackers hold admin rights, killing security tools with a signed driver and spreading through SYSVOL work in any Windows domain, including a 20-person office with one server. Microsoft’s vulnerable driver blocklist, if switched on, blocks drivers on Microsoft’s list; ask your endpoint provider whether it covers this one. The victims were in Portuguese- and Spanish-speaking regions, but nothing about the method is regional.
What to do now
- Find out whether any on-premises SharePoint Server exists in your environment, including old intranet or test servers.
- Install the current SharePoint Server security updates for Subscription Edition, 2019 or 2016, as Microsoft directs. Being patched for July 2025 alone is not enough, given the newer flaws now in use.
- After patching, generate new ASP.NET machine keys for SharePoint, then restart IIS on each SharePoint server. Symantec says the attackers abuse those keys, so stolen ones can outlive the patch.
- Turn on AMSI integration in Full Mode and run Microsoft Defender Antivirus on SharePoint servers. If AMSI cannot be enabled, Microsoft suggests considering taking the server off the internet until it is updated.
- Hunt for the footprints in Symantec’s report: unexpected .aspx files in the LAYOUTS folder, code-insiders.exe running as a service, nxc.exe, run.exe or rune.exe, and executables in SYSVOL that your admins did not put there.
- Harden accounts against credential spraying inside the domain: account lockout policies, long unique passwords and alerts on bursts of failed logons. Use Microsoft LAPS to randomize local admin passwords, which limits lateral movement once one machine falls. Put multi-factor authentication on all external remote access; our MFA tools guide lists options that suit small teams.
Oreaxe’s take
A ransomware crew still listing 2025 bugs in its toolkit tells you more about patching than about the attackers. Some of the flaws this group relies on have had fixes since July 2025, and the newer ones only reward servers that fall behind again.
Our view: if a small business keeps an on-premises SharePoint server, it should either commit to monthly patching with someone accountable for it, or move the content to SharePoint Online, which Microsoft says the ToolShell flaws do not affect. Keeping an unpatched server because migration feels like work is the most expensive option on the table.
The SYSVOL trick is also worth a conversation with whoever runs your domain. An alert on new executables or scripts appearing in SYSVOL, or on changes by accounts that do not normally manage Group Policy, is a cheap alarm. For the wider picture of where ransomware fits in a small firm’s plan, see 7 cyber threats every small business should plan for.
Sources
- Symantec / Carbon Black: Warlock Ransomware Attackers Hit Water and Telecom Operators (October 1, 2026)
- The Record: Warlock ransomware used in attacks on critical infrastructure (October 2, 2026)
- BleepingComputer: Warlock ransomware breach SharePoint in water, telecom operator attacks (October 2, 2026)
- Microsoft Security: Disrupting active exploitation of on-premises SharePoint vulnerabilities (July 22, 2025)
Every factual claim links to its source. Spotted an error? Tell us.