Symantec attributes recent attacks on at least four organizations to Longlegs, which it tracks as Storm-2603. The group exploited SharePoint, disabled security tools and deployed Warlock ransomware across victim networks.
Symantec reports that multiple threat actors have used the legitimate Node.js runtime in attacks since February 2026, including intrusions involving PowerShell, ransomware-linked malware and an implant that contacted Ethereum gateways.
Symantec researchers detail Jewelbug’s espionage and crypto-fraud operations, including its browser and endpoint implants, government webmail watering-hole campaign, and database records of more than one million implant check-ins.