Warlock ransomware group narrows its targets to large Spanish- and Portuguese-speaking organizations
Warlock, the group Microsoft tracks as Storm-2603, hit four organizations in Spanish- or Portuguese-speaking countries in two months, Symantec says. It works like the Chinese state groups it first appeared beside and extorts like a ransomware crew.
The Watch · Security desk
What happened
- Symantec's four observed victims were a water utility, a telecommunications provider, a regional government body and a university.
- Warlock gets initial access by exploiting Microsoft SharePoint, and its earliest attacks used the exploit chain known as ToolShell.
- After entry it sideloads DLLs, uses a signed but vulnerable driver to kill security processes, and opens remote access through Visual Studio Code tunnels.
- Microsoft saw the group's campaigns end in Warlock and LockBit ransomware but could not say for certain what its motives were.
Why it matters
- Who's exposed exposure Organizations in these countries running on-premises SharePoint without the summer's KEV fixes are within Warlock's reach, because Symantec cannot rule out the newer flaws.
- What it limits constraint Alerts built around PsExec or WMI fan-out are not looking for a payload that Active Directory replication delivers; writes to SYSVOL are where the staging shows.
- What it sets up precedent At two victims a month in one language region, Warlock is running a sustained regional campaign, and organizations in those countries are its likeliest next targets.
Next story · Leadership · 2d ago
Microsoft's October release of 1,407 CVEs tops 2020's full-year record by 146Confirmed23 publishers
Symantec could not say whether the current wave still runs on ToolShell or on one of the newer SharePoint flaws that CISA added to its Known Exploited Vulnerabilities catalog over the summer [14]. For a defender the difference is small [15]. Dick O'Brien, principal intelligence analyst for Symantec's Threat Hunter Team, said "the exploits for these more recent vulnerabilities behave quite similarly" to ToolShell [15].
The way the locker is delivered is the least familiar step [7]. "They stage the ransomware payload in the domain's system volume (SYSVOL) share to let ordinary Active Directory (AD) replication carry it to every domain controller, rather than pushing it to every host with a remote execution tool," O'Brien said [6]. He said attackers have used the trick before, "but it's a bit more efficient of a living-off-the-land approach, and less well known than using tools like PsExec or Windows Management Instrumentation (WMI)" [7].
Microsoft first saw the group in July 2025. It was the third actor exploiting the ToolShell zero-days in on-premises SharePoint, alongside APT27 and APT31 [11]. Those two are established state espionage groups. Storm-2603 was new [11]. In its early campaigns it borrowed state-level espionage techniques but deployed ransomware without apparent discrimination, according to Dark Reading [4]. Symantec now sees fewer, more valuable targets [1]. Its count works out to two victims a month [13]. Dark Reading calls Warlock a Chinese outfit [9]. It says the victims are the kinds of critical organizations usually targeted by state groups [10].
The record supports two things: espionage-grade tradecraft and state-style target selection [4][10]. Symantec's findings, as reported, do not name the victims or the countries, and do not say whether data left any network before encryption. In my view a responder should still scope a Warlock case as a full intrusion. The locker arrives only after the SharePoint foothold, the disabled security tools and the remote tunnel are already in place [5][6].
What to watch
- Symantec or Microsoft naming the SharePoint CVEs behind the current intrusions, giving defenders a specific patch list beyond ToolShell.
- A disclosure from any of the four victims showing how long the attackers were inside before encryption.
- Evidence of data theft or leak-site postings tied to Warlock, either of which would bear on whether the group wants money, intelligence or both.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+15
- Incentives30
- Confidence68
Perspective Coverage
6 publishers- Builder
- Builder 32%
- Operator
- Operator 59%
- Investor
- Investor 9%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
According to Symantec research, Warlock has been entirely focused on countries where Spanish or Portuguese is the lingua franca, and is targeting fewer, more valuable targets.
- [2]
In the last two months, researchers observed Warlock attacks against four victims: a water utility, a telecommunications provider, a regional government body and a university.
- [3]
The Warlock ransomware group is tracked by Symantec as "Longlegs" and by Microsoft as "Storm-2603".
- [4]
Warlock surfaced in summer 2025 in a campaign whose tactics, techniques and procedures mirrored state-level espionage activity, yet it acted like a cybercrime gang, deploying ransomware against organizations without any apparent discrimination.
- [5]
After initial access, Warlock uses DLL sideloading, a signed but vulnerable driver to help terminate security processes (BYOVD), and living-off-the-land techniques such as Visual Studio Code's remote tunneling feature to establish remote access that blends with legitimate traffic.
- [6]
"They stage the ransomware payload in the domain's system volume (SYSVOL) share to let ordinary Active Directory (AD) replication carry it to every domain controller, rather than pushing it to every host with a remote execution tool," O'Brien said.
- [7]
O'Brien said it is not the first time attackers have tried the SYSVOL technique, "but it's a bit more efficient of a living-off-the-land approach, and less well known than using tools like PsExec or Windows Management Instrumentation (WMI)."
- [8]
Warlock exploits Microsoft SharePoint vulnerabilities to gain initial access; its earliest attacks used the exploit chain known as ToolShell.
- [9]
Dark Reading describes Warlock as a Chinese ransomware outfit exploiting Microsoft technologies to extort large and critical organizations in the Spanish- and Portuguese-speaking world.
- [10]
Warlock has been attacking the kinds of significant, critical organizations that are typically seen in the sights of APTs.
- [11]
In July 2025 Microsoft discovered China-nexus threat actors exploiting zero-day vulnerabilities in on-premises SharePoint (the ToolShell chain): APT27 and APT31, established state espionage APTs, and a previously unknown actor Microsoft labeled Storm-2603.
- [12]
Microsoft noted Storm-2603's campaigns culminated in delivering Warlock ransomware along with LockBit, but its analysts were unable to say for certain what the group's motivations were.
- [13]
Four observed victims over two months is a rate of two victims a month.
- [14]
Symantec could not say whether Warlock is still using ToolShell or newer SharePoint vulnerabilities; CISA added a handful of SharePoint vulnerabilities to its Known Exploited Vulnerabilities catalog over the summer.
- [15]
Dick O'Brien, principal intelligence analyst for the Symantec Threat Hunter Team, said "the exploits for these more recent vulnerabilities behave quite similarly" to ToolShell.
Sources
6 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comWarlock ransomware breach SharePoint in water, telecom operator attacks
1 article · October 2, 2026
- darkreading.comWarlock Ransomware Hits Large Spanish, Portuguese Orgs
1 article · October 1, 2026
- scworld.comChinese ransomware group Warlock targets Spanish- and Portuguese-speaking countries
1 article · October 1, 2026
- securityaffairs.comWarlock Ransomware Still Exploits Year-Old SharePoint Flaws to Hit Critical Infrastructure
1 article · October 4, 2026
- thehackernews.comWarlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
1 article · October 3, 2026
- therecord.media'Warlock' ransomware used in attacks on critical infrastructure in Portuguese, Spanish-speaking countries
1 article · October 2, 2026
Topics and entities
Topics
- Ransomware
- Critical infrastructure security
- SharePoint security
- Bring Your Own Vulnerable Driver
- Living-off-the-land attacks