Warlock Ransomware Targets Spanish- and Portuguese-Speaking Organizations
Summary
Symantec observed Warlock ransomware attacks on four organizations in Spanish- and Portuguese-speaking countries. The group exploits Microsoft SharePoint for access and uses techniques including DLL sideloading, vulnerable drivers, and Active Directory replication to, [
Key points
- Symantec observed attacks on four victims in the past two months: a water utility, telecom provider, regional government body, and university.
- Warlock, also tracked as Longlegs and Microsoft Storm-2603, has shifted from geographically broad targeting to Spanish- and Portuguese-speaking countries.
- The group gains initial access by exploiting Microsoft SharePoint vulnerabilities; researchers could not confirm whether it still uses the ToolShell chain or newer flaws.
- After access, Warlock uses DLL sideloading, a signed but vulnerable driver to terminate security processes, and Visual Studio Code remote tunneling.
- It stages ransomware in the Active Directory SYSVOL share, allowing normal replication to distribute the payload to domain controllers.
- Warlock’s targeting and ransomware activity complicate efforts to distinguish it from state-linked espionage actors.
Article Details
- Attack Vectors
- Warlock exploits Microsoft SharePoint vulnerabilities to gain initial access; its earliest attacks used the ToolShell exploit chain. Researchers could not confirm whether it still uses ToolShell or has moved to newer SharePoint vulnerabilities.
- After gaining access, Warlock uses DLL sideloading and a signed but vulnerable driver to terminate security processes.
- Warlock uses Visual Studio Code remote tunneling to establish remote access that blends with legitimate network traffic.
- Warlock stages its ransomware payload in the domain's SYSVOL share, allowing Active Directory replication to distribute it to domain controllers.
- Defensive Notes
- Review and patch on-premises SharePoint systems against known exploited vulnerabilities; the article does not identify specific CVEs.
- Monitor for DLL sideloading, use of signed but vulnerable drivers to terminate security processes, and unexpected Visual Studio Code remote tunneling.
- Monitor SYSVOL for staged ransomware payloads and unusual distribution through Active Directory replication.
MITRE ATT&CK
T1219 · Remote Access ToolsWarlock uses Visual Studio Code's remote tunneling feature to establish remote access.T1562.001 · Disable or Modify ToolsWarlock uses a signed but vulnerable driver to terminate security processes.T1574.002 · DLL Side-LoadingWarlock uses DLL sideloading after establishing initial access.
People
Threat Actors
APT31China-nexus threat actor identified as one of the groups exploiting SharePoint zero-days in July 2025; also known as Zirconium and Violet Typhoon.LonglegsSymantec's tracking name for the Warlock ransomware group.Play groupRansomware group cited as one of the first to seriously target Latin America.SHORE CASTLEChina-nexus threat actor identified as one of the groups exploiting SharePoint zero-days in July 2025; also known as Emissary Panda, Bronze Union, and Linen Typhoon.Storm-2603Microsoft's label for the threat actor now better known as Warlock.WarlockRansomware group; tracked by Symantec as Longlegs and by Microsoft as Storm-2603.
Malware
LockBitMicrosoft noted that its campaigns culminated in delivering the eponymous Warlock ransomware, along with Lockbit. Even so, the analysts were unable to say for certain what the group's motivations were.WarlockThe Warlock ransomware group — tracked by Symantec as "Longlegs" and by Microsoft as "Storm-2603" — has never fit neatly into any box. It surfaced in the summer of 2025, in a campaign that mirrored state-level espionage
Vendors
MicrosoftA Chinese ransomware outfit is exploiting Microsoft technologies to extort large and critical organizations in the Spanish- and Portuguese-speaking world.SymantecThe Warlock ransomware group — tracked by Symantec as "Longlegs" and by Microsoft as "Storm-2603" — has never fit neatly into any box. It surfaced in the summer of 2025, in a campaign that mirrored state-level espionage
Products
Active Directory"They stage the ransomware payload in the domain's system volume (SYSVOL) share to let ordinary Active Directory (AD) replication carry it to every domain controller, rather than pushing it to every host with a remoteMicrosoft SharePointWarlock exploits Microsoft SharePoint vulnerabilities as a way to gain initial access to its targets. Its earliest attacks utilized the exploit chain known as "ToolShell."Visual Studio Codeto help terminate security processes (BYOVD), and living-off-the-land (LotL) techniques, like using Visual Studio Code's (VS Code) remote tunneling feature to establish remote access that blends with legitimate network
Tools
PsExecit’s a bit more efficient of a living-off-the-land approach, and less well known than using tools like PsExec or Windows Management Instrumentation (WMI)."Windows Management Instrumentationof a living-off-the-land approach, and less well known than using tools like PsExec or Windows Management Instrumentation (WMI)."
Countries
BrazilEarlier Warlock campaigns crossed the world's largest developed countries: Brazil, India, Japan, Russia, Taiwan, and the United States — essentially a random sampling. Now Warlock is going after organizations inIndiaEarlier Warlock campaigns crossed the world's largest developed countries: Brazil, India, Japan, Russia, Taiwan, and the United States — essentially a random sampling. Now Warlock is going after organizations inJapanEarlier Warlock campaigns crossed the world's largest developed countries: Brazil, India, Japan, Russia, Taiwan, and the United States — essentially a random sampling. Now Warlock is going after organizations inRussiaEarlier Warlock campaigns crossed the world's largest developed countries: Brazil, India, Japan, Russia, Taiwan, and the United States — essentially a random sampling. Now Warlock is going after organizations inTaiwanEarlier Warlock campaigns crossed the world's largest developed countries: Brazil, India, Japan, Russia, Taiwan, and the United States — essentially a random sampling. Now Warlock is going after organizations inUnited Statescrossed the world's largest developed countries: Brazil, India, Japan, Russia, Taiwan, and the United States — essentially a random sampling. Now Warlock is going after organizations in Spanish- and
Industries
EducationGovernmentIn the last two months, researchers observed Warlock attacks against four victims: a water utility, a telecommunications provider, a regional government body, and a university.TelecommunicationsIn the last two months, researchers observed Warlock attacks against four victims: a water utility, a telecommunications provider, a regional government body, and a university.Water utilities