Date: October 4, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Threat Intelligence / Ransomware / Critical Infrastructure / State-Sponsored APT
Tags: Warlock, Storm-2603, Longlegs, Gold Salem, China, SharePoint, Ransomware, Critical Infrastructure, Symantec, Aviatrix
Executive Summary
In early October 2026, threat researchers from Symantec, The Record Media, and Aviatrix Threat Research published an in-depth investigation exposing an aggressive cyber extortion and ransomware campaign executed by the China-linked threat group Warlock (also tracked as Storm-2603, Longlegs, or Gold Salem).
Active across Portuguese- and Spanish-speaking nations in Europe, Latin America, and Africa, Warlock has expanded its operations from commercial extortion to targeted assaults on critical infrastructure entities—including municipal water utilities, national telecommunications operators, regional government ministries, and universities. The group leverages unpatched vulnerabilities in Microsoft SharePoint on-premises servers to gain initial access, extracts ASP.NET machine keys to forge authentication tokens, weaponizes legitimate forensic tools like Velociraptor for covert command-and-control, deploys Bring-Your-Own-Vulnerable-Driver (BYOVD) rootkits to terminate EDR sensors, and rapidly distributes ransomware enterprise-wide through Active Directory SYSVOL network shares.
Deep-Dive Technical Breakdown of Warlock's Attack Chain
The Warlock campaign represents a fusion of state-sponsored cyber espionage tradecraft with financially motivated ransomware extortion:
1. Initial Infiltration via Microsoft SharePoint Exploits
Warlock threat actors consistently prioritize public-facing Microsoft SharePoint collaboration portals as their primary ingress gateway:
* Exploitation of Known SharePoint Flaws: Intruders target unpatched on-premises SharePoint deployments using known remote code execution vulnerabilities (such as CVE-2023-29357, CVE-2023-38177, and recent deserialization bugs).
* Web Shell Deployment: Upon achieving initial execution, attackers drop lightweight, obfuscated ASPX web shells into SharePoint application layouts directories (_layouts/), establishing an interactive web-based foothold.
* Extraction of ASP.NET Machine Keys: Warlock immediately dumps the SharePoint farm's web.config files to extract the cryptographic validationKey and decryptionKey. Using these keys, the attackers forge administrative ASP.NET authentication cookies, allowing persistent access even if the original web shell is detected and removed.
2. Living-off-the-Land and Legitimate Tool Abusal (Velociraptor C2)
To evade endpoint detection during lateral expansion, Warlock avoids off-the-shelf Cobalt Strike or Meterpreter payloads in favor of dual-use open-source tools:
* Velociraptor Deployment: The attackers install and configure Velociraptor—a widely respected open-source digital forensics and incident response (DFIR) platform—as their primary command-and-control client. Because Velociraptor uses signed, legitimate binaries, network traffic and client execution are routinely white-listed by SOC analysts.
* Active Directory Enumeration: Leveraging Velociraptor scripts and AdFind, the actors map domain trusts, identify critical operational databases, and locate backup servers.
3. EDR Neutralization via BYOVD Rootkits
Before deploying their encryptor, Warlock ensures endpoint security software cannot detect or interrupt encryption:
* The Vulnerable Driver Tactic: Attackers deploy a signed, legitimate, yet vulnerable third-party hardware driver to Windows endpoints.
* Kernel-Level Termination: Exploiting the driver's kernel read/write primitive, Warlock terminates kernel callbacks, unhooks EDR monitoring routines, and forcibly terminates endpoint security services (including Windows Defender, CrowdStrike Falcon, and SentinelOne) at Ring 0.
4. Ransomware Distribution via Active Directory SYSVOL
With defenses neutralized, Warlock executes rapid, synchronized encryption:
* SYSVOL Policy Staging: The ransomware executable is placed inside the domain controller's SYSVOL\Policies share.
* Group Policy Scripting: The attackers create a Group Policy Object (GPO) or scheduled task that forces every connected workstation and server to fetch and execute the ransomware payload simultaneously during routine policy refreshes.
Attack Dimension
Forensic Detail
Threat Actor
Warlock (Storm-2603 / Longlegs / Gold Salem)
Attribution
China-nexus cyber threat syndicate
Target Sectors
Municipal Water Utilities, Telecommunications, Regional Governments, Universities
Initial Access Vector
Remote Code Execution flaws in on-premises Microsoft SharePoint servers
Credential Abuse
ASP.NET Machine Key extraction (web.config) for administrative cookie forgery
C2 Framework
Weaponized open-source Velociraptor DFIR framework
Defense Evasion
Bring-Your-Own-Vulnerable-Driver (BYOVD) terminating Ring 0 EDR hooks
Deployment Mechanism
Active Directory Group Policy Objects (GPOs) executing from domain SYSVOL
The Threat to Water Utilities and Telecommunications
Targeting utility and telecommunications infrastructure marks a dangerous operational escalation:
* Cascading Infrastructure Risk: While the ransomware attacks primarily impacted corporate billing and administrative IT environments, lateral movement in water utilities presents serious risks of crossing IT/OT boundaries into SCADA and programmable logic controller (PLC) networks.
* Telecommunications Disruption: Compromising telecom backbones provides threat actors with passive traffic interception capabilities and endangers emergency dispatch communications.
Recommendations and Mitigations
Organizations running Microsoft SharePoint, critical infrastructure operators, and enterprise IT teams should immediately implement the following protections:
1. Patch On-Premises Microsoft SharePoint Immediately: Apply the latest cumulative security updates for Microsoft SharePoint Enterprise Server and disable anonymous access to all web application zones.
2. Protect ASP.NET Machine Keys and Web.config Files: Restrict filesystem permissions on web.config files and immediately re-generate and rotate ASP.NET machine keys across SharePoint farms if intrusion signs exist.
3. Block Untrusted Driver Loading (Mitigate BYOVD):
* Enable Hypervisor-Protected Code Integrity (HVCI) and Memory Integrity in Windows Security.
* Enforce Microsoft's Recommended Vulnerable Driver Blocklist via Windows Defender Application Control (WDAC).
4. Audit and Restrict Active Directory SYSVOL Permissions: Lock down write permissions on SYSVOL and Group Policy templates, ensuring that only verified Domain Admins can create or modify GPOs.
5. Monitor for Unauthorized Velociraptor or RMM Tools: Implement application control rules that alert on or block unauthorized installations of remote monitoring or forensic agents across production servers.