The PolySwarm Blog

Verticals Targeted: Water, Telecommunications, Government, Education
Regions Targeted: Europe, Africa, Latin America
Related Families: Warlock
Related Threat Actors: Longlegs

Executive Summary

A China-nexus threat actor tracked by Symantec as Longlegs is continuing to exploit vulnerabilities in on-premises Microsoft SharePoint Server to deploy Warlock ransomware, with recent victims including water and telecommunications operators, a regional government body, and a university. The group combines SharePoint exploitation with webshells, DLL sideloading, living-off-the-land techniques, vulnerable driver abuse, and Visual Studio Code tunneling before disabling security tools and deploying ransomware across compromised environments. In one critical infrastructure intrusion, the attackers deployed an AV/EDR-killing tool to at least 40 hosts within approximately two hours and subsequently delivered Warlock to at least 33 systems, using the victim's own SYSVOL replication infrastructure as part of the ransomware distribution process.

Verticals Targeted: Government, Defense, NGOs, Think Tanks, Education, Media, Financial, Healthcare
Regions Targeted: US, Europe, East Asia, Africa 
Related Families: Warlock, LockBit

Executive Summary

Microsoft has disclosed active exploitation of critical vulnerabilities in on-premises SharePoint servers by Chinese threat actors, urging immediate patching and additional mitigations to prevent unauthorized access and data theft.