Warlock Ransomware Hits 4 Sectors via SharePoint Bug | #ransomware | #cybercrime

A China-linked ransomware operation known as Warlock has breached at least four organizations across water utilities, telecommunications, regional government, and higher education in the two months leading up to October 1, 2026, according to a report from Symantec’s threat-intelligence arm, Security.com. The attackers did not need a new vulnerability to get in. They reused a Microsoft SharePoint flaw chain called ToolShell, first exploited in July 2025, that on-premises SharePoint administrators have had more than a year to patch.

The campaign landed in the same week Comparitech published its Q3 2026 ransomware tracker, which counted 2,627 claimed ransomware attacks globally in the quarter, the highest total the firm has recorded. Warlock’s four confirmed victims are a tiny fraction of that number, but the sectors it chose, critical infrastructure, telecom, and public institutions, are exactly the targets that keep showing up when ransomware stops being a nuisance and starts being a national-security conversation. Here is what the evidence actually supports, what SharePoint administrators need to check right now, and where the gaps in public reporting still sit.

What Happened in Warlock’s October 2026 Campaign

Security.com’s October 1 report, corroborated two days later by BleepingComputer, describes Warlock operators exploiting on-premises Microsoft SharePoint servers at a water utility, a telecommunications provider, a regional government body, and a university. The reports do not name the organizations, and they stop short of claiming this is a complete global victim count. The phrase researchers use is “at least four,” which is a meaningful qualifier: it describes confirmed cases researchers could verify, not the full scope of exploitation across every exposed SharePoint deployment worldwide.

Separately, Check Point Research’s October 5 threat intelligence report and other technical write-ups describe ransomware deployment across more than 33 systems in connected incidents, a host-level count rather than an organization-level count. That distinction matters for anyone trying to size the blast radius: 33 compromised machines could belong to four organizations with wide internal networks, or to a larger set of victims than the “at least four” figure captures. Public reporting has not reconciled the two numbers into a single confirmed total.

Who Is Warlock? A China-Linked Operation With Several Names

Aliases That Point to the Same Group

Threat intelligence teams track Warlock under multiple aliases, including Longlegs, Gold Salem, and Storm-2603. Different vendors assign different tracking labels to overlapping infrastructure and tooling, which is standard practice in an industry where no two companies see an identical slice of telemetry. Security.com and other outlets describe the group as China-linked, and reporting places its first appearance around June 2025, shortly before it began weaponizing the SharePoint flaws that would make it one of the more closely watched ransomware operations of the past year.

Public reporting does not establish a confirmed operational link between Warlock and better-known ransomware-as-a-service brands like LockBit. That absence of a confirmed connection is itself worth noting, since threat intelligence vendors are often quick to draw lineage lines between groups when the evidence supports it. Warlock appears to be tracked as its own distinct operation, built around exploiting a specific, well-documented vulnerability chain rather than running a sprawling affiliate program the way some Eastern European ransomware brands do.

Inside the ToolShell Vulnerability Chain

ToolShell is the name researchers gave to a set of four chained Microsoft SharePoint vulnerabilities. Microsoft’s security team disclosed and patched the first pair, CVE-2025-49704, a remote-code-execution flaw, and CVE-2025-49706, a spoofing vulnerability, on July 8, 2025. Within days, Microsoft discovered that attackers had found a way to bypass those fixes, leading to emergency patches for CVE-2025-53770 and CVE-2025-53771, published on July 19 and July 22, 2025. Microsoft’s own security blog documented the active exploitation at the time and described the coordinated response across its detection and patch teams.

The chain affects self-hosted, on-premises deployments of SharePoint Server 2016, 2019, and the Subscription Edition. Microsoft’s guidance has been consistent since 2025: SharePoint Online, the cloud-hosted version most organizations have migrated to, is not implicated in ToolShell. The vulnerability only matters to organizations still running SharePoint on their own servers, which is a shrinking but far from negligible population, particularly among government agencies, utilities, and universities that tend to run on-premises infrastructure longer than commercial enterprises do.

From Emergency Patch to a 2026 Rebound

What makes the October 2026 wave notable is that it is not a new zero-day story. It is a story about a fifteen-month-old, fully patched vulnerability chain still finding victims. SecurityWeek’s retrospective coverage noted that researchers had already uncovered numerous Warlock attacks tied to ToolShell by October 2025, a full year before this latest wave. That means the group has treated the same vulnerability chain as a reliable, reusable entry point across more than a year of operations, rather than burning it after the initial disclosure forced most organizations to patch.

That pattern tracks with a broader truth about on-premises enterprise software: a patch being available is not the same as a patch being applied. Water utilities, regional government bodies, and universities frequently run change-control processes that make emergency patching slower than it is in a cloud-native SaaS company, and some may have applied the original July 8 fixes without realizing the follow-up emergency patches for the bypass vulnerabilities were a separate, mandatory step. Organizations that patched once in mid-July 2025 and considered the issue closed may have left themselves exposed to the second half of the chain.

Why On-Premises SharePoint Keeps Getting Hit

Patched But Not Protected

Technical analysis from Trellix breaks down why ToolShell has had such staying power. The vulnerability chain targets deserialization logic inside SharePoint’s web application layer, letting an attacker who successfully exploits the flaw extract cryptographic machine keys from the server. Those keys can then be reused to forge valid-looking requests even after a server has been patched, unless administrators also rotate the keys and restart the affected services, a step that is easy to miss if an organization treats “install the patch” as the entire remediation checklist rather than the first of several required actions.

This is the technical reason a fifteen-month-old vulnerability chain keeps producing fresh victims in October 2026. An organization can apply every Microsoft security update released since July 2025 and still be compromised if it never rotated the machine keys an earlier intrusion may have already stolen. The European Commission’s joint technical assessment of the original 2025 incident flagged exactly this risk, advising organizations to treat key rotation as a mandatory recovery step rather than an optional hardening measure.

A Record Ransomware Quarter Sets the Backdrop

Warlock’s campaign did not happen in isolation. Comparitech’s Q3 2026 tracker, published in early October, recorded 2,627 claimed ransomware attacks globally, the highest quarterly figure in the firm’s tracking history. The report also noted that fewer than one in ten victims publicly confirm an attack, which means the true scale of ransomware activity in any given quarter is almost certainly higher than the already-record number that made headlines.

Reading the Warlock numbers against the Comparitech total requires some care. Four confirmed victims against 2,627 claimed attacks is a tiny fraction, well under one percent, and the two datasets do not necessarily overlap in a way that is easy to verify independently. What makes Warlock’s activity disproportionately significant is not its share of total attack volume but its target selection. A record quarter for ransomware overall, combined with even a handful of confirmed hits against water utilities and telecom infrastructure, is the kind of pairing that tends to accelerate regulatory attention regardless of how small the raw victim count looks next to the broader total.

Market and Enterprise Security Impact

For enterprise security buyers, the Warlock campaign reinforces a budget argument that has been building since the original 2025 ToolShell disclosure: on-premises SharePoint, and on-premises enterprise software generally, carries a different and arguably higher long-term maintenance cost than the sticker price suggests once patch-and-rotate cycles, change-control delays, and the cost of incident response after a missed step are all factored in. Organizations that migrated fully to SharePoint Online sidestepped this entire vulnerability chain, which is a point cloud vendors have been making to on-premises holdouts for years and now have a concrete, recent example to cite.

There is also a sector-specific angle. Water utilities and regional government bodies often operate under tighter procurement and budget constraints than private enterprises, which can mean slower adoption of cloud migration, slower patch cycles, and thinner security staffing. Comparitech’s finding that finance, technology, education, and healthcare saw significant increases in ransomware activity during the quarter suggests Warlock’s sector choices were not random. Insurers and managed security providers covering critical infrastructure clients are likely to tighten SharePoint-specific questions in renewal and onboarding questionnaires following this disclosure, mirroring how similar KEV-listed vulnerabilities have shaped policy language in prior incidents this year.

How Warlock Compares to Other 2026 Ransomware Operations

Warlock’s approach differs from the opportunistic, mass-scanning model that defines many financially motivated ransomware-as-a-service crews, which tend to hit whatever is exposed and vulnerable regardless of sector. Warlock’s reported targeting, concentrated on critical infrastructure, telecom, government, and education, reads closer to the selective targeting patterns associated with state-linked operations, even though researchers have not classified the group’s motive as purely espionage-driven. The group’s willingness to keep exploiting the same fifteen-month-old vulnerability chain rather than rotating to newer CVEs also sets it apart from crews that chase the latest KEV additions as soon as proof-of-concept code circulates.

That persistence-over-novelty strategy has a practical advantage for Warlock: ToolShell’s post-exploitation payoff, stolen machine keys that remain valid after a patch, means the group can keep returning to targets that patched the vulnerability but skipped the key-rotation step. Ransomware operations built around chasing fresh zero-days have to find a new way in with every campaign. Warlock’s model means organizations that handled the 2025 remediation incompletely remain exploitable more than a year later, a durability advantage few other 2026 ransomware campaigns have demonstrated at this length.

Detection and Mitigation Guidance for SharePoint Administrators

Organizations running on-premises SharePoint Server 2016, 2019, or Subscription Edition should treat this report as a prompt to re-verify their 2025 remediation rather than assume a historical patch closed the issue. The checklist security teams are circulating this month covers four steps: confirm all four CVEs in the ToolShell chain have corresponding security updates installed, not just the original July 8 pair; rotate the ASP.NET machine keys on every affected SharePoint farm, since stolen keys remain valid independent of patch status; restart IIS and related services after key rotation to force the new keys into effect; and review IIS logs for anomalous w3wp.exe process behavior or unexpected child processes spawned from the SharePoint application pool, which is the forensic signature most commonly associated with ToolShell exploitation.

# PowerShell: check installed SharePoint security updates against ToolShell CVEs
Get-HotFix | Where-Object { $_.Description -match "SharePoint" } | Select-Object HotFixID, InstalledOn

# Rotate ASP.NET machine keys after confirming patches (run on each SharePoint server)
Update-SPMachineKey
# Then restart IIS to force new keys into effect
iisreset

# Hunt for anomalous child processes spawned by the SharePoint app pool (classic ToolShell IOC)
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" |
  Where-Object { $_.Message -match "w3wp.exe" -and $_.Id -eq 1 } |
  Select-Object TimeCreated, Message

That script reflects standard Microsoft-documented remediation guidance for the ToolShell chain rather than a vendor-published detection signature specific to the October 2026 Warlock wave, since no security firm in the current reporting has released campaign-specific indicators of compromise. Administrators should pair it with their own EDR platform’s threat-hunting queries for deeper coverage.

What Remains Unverified

Several details in this story are not yet confirmed by named sources. No report has published the identities of the four victim organizations, and researchers have been explicit that “at least four” describes confirmed cases rather than a total global count. The relationship between the four-organization figure and the 33-plus compromised-systems figure from Check Point has not been reconciled into a single number. No CISA advisory or Known Exploited Vulnerabilities catalog entry tied specifically to this October 2026 wave appears in current public reporting, even though the underlying CVEs were addressed by Microsoft and referenced in a 2025 European Commission joint statement. And while multiple vendors describe Warlock as China-linked, no source in current reporting confirms a formal government attribution or a demonstrated operational link to LockBit or other named ransomware-as-a-service brands.

What Happens Next: Five Predictions

Based on how the original 2025 ToolShell disclosure and comparable 2026 appliance and platform exploitation campaigns have played out, several outcomes look likely in the coming weeks. First, expect additional victim disclosures tied to this specific Warlock wave as more affected organizations complete forensic investigations, since the “at least four” figure has historically grown in similar campaigns once incident responders compare notes across engagements. Second, expect Microsoft or CISA to publish renewed guidance specifically emphasizing machine-key rotation as a mandatory step, given how clearly the key-theft mechanism explains why a fifteen-month-old, fully patched vulnerability keeps producing new victims.

Third, expect cloud migration vendors to use this campaign as a selling point against on-premises SharePoint holdouts, particularly in the government and education sectors where migration budgets have lagged. Fourth, expect Comparitech’s Q4 2026 ransomware tracker to show continued elevated attack volume rather than a reversion to pre-2026 norms, given the broader sector trends the Q3 report already flagged across finance, technology, education, and healthcare. Fifth, expect at least one additional threat intelligence vendor to publish independent confirmation or refinement of the Warlock attribution, including a clearer picture of whether the group operates with state backing or as an independently motivated financial actor using nation-state-style targeting discipline.

The Bigger Picture for Security Teams

Warlock’s October 2026 campaign is a reminder that the ransomware threat landscape is not solely driven by brand-new zero-days. A chain of vulnerabilities disclosed and patched more than a year ago is still producing confirmed victims in critical infrastructure, telecom, government, and education, specifically because the fix required more than installing an update. Outlets including The Cyber Express have tracked the broader 2026 pattern of ransomware operators returning to incompletely remediated vulnerabilities rather than always chasing the newest disclosure, and Warlock’s persistence with ToolShell fits that pattern precisely.

For any organization still running on-premises SharePoint Server, the action items are not ambiguous regardless of how the attribution and full-victim-count questions eventually resolve: verify all four ToolShell CVEs are patched, rotate machine keys, restart affected services, and hunt for the process-level indicators associated with the original 2025 exploitation. A record ransomware quarter combined with confirmed hits against a water utility and a telecom provider is not a story to file away as resolved just because the underlying vulnerability has a patch that is more than a year old.

Frequently Asked Questions

What is the Warlock ransomware group?
Warlock is a ransomware operation also tracked under the aliases Longlegs, Gold Salem, and Storm-2603. Researchers describe it as China-linked, with first activity reported around June 2025. It has become known for exploiting Microsoft SharePoint’s ToolShell vulnerability chain against on-premises servers.

What is ToolShell?
ToolShell is the name given to a chain of four Microsoft SharePoint vulnerabilities: CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771. Microsoft disclosed and patched the first pair on July 8, 2025, then issued emergency patches for the second pair after attackers found a way to bypass the original fixes.

Which SharePoint versions are affected?
Self-hosted, on-premises deployments of SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. SharePoint Online, Microsoft’s cloud-hosted version, is not affected by the ToolShell chain.

How many organizations has Warlock’s October 2026 campaign affected?
Security.com and BleepingComputer report at least four confirmed organizations, a water utility, a telecommunications provider, a regional government body, and a university, during the roughly two months leading up to October 1, 2026. Related reporting from Check Point describes ransomware deployment across more than 33 systems, a host-level count that has not been reconciled with the organization-level figure.

I patched ToolShell in 2025. Am I still at risk?
Possibly. Installing the patches alone does not invalidate cryptographic machine keys an earlier intrusion may have already stolen. Security researchers recommend rotating ASP.NET machine keys and restarting affected services in addition to confirming all four CVEs are patched.

Is this a new vulnerability or the same one from 2025?
The same vulnerability chain. No new 2026 CVE has been identified in current reporting. Warlock is reusing the fifteen-month-old ToolShell chain rather than exploiting a newly disclosed flaw, which researchers attribute to the group’s success exploiting incomplete remediation across different victims.

How does this relate to the record ransomware numbers in Q3 2026?
Comparitech recorded 2,627 claimed ransomware attacks globally in Q3 2026, the highest quarterly figure in its tracking history. Warlock’s four confirmed victims are a small fraction of that total, but the critical-infrastructure and telecom targeting makes the campaign disproportionately significant relative to its raw victim count.

Has CISA added the ToolShell CVEs to its Known Exploited Vulnerabilities catalog for this campaign?
Current public reporting does not show a CISA KEV entry specific to the October 2026 Warlock wave. The underlying CVEs were addressed through Microsoft’s 2025 emergency patches and referenced in a European Commission joint technical statement, but no CISA advisory tied to this specific campaign appears in available sources.

Related Coverage