Actor Profile

Warlock (also tracked as Gold Salem, Longlegs, Storm-2603) is a suspected China-linked threat actor that gained prominence in mid-2025 through zero-day exploitation of Microsoft SharePoint vulnerabilities dubbed "ToolShell." The group is attributed by Symantec to share overlaps with older activity clusters CL-CRI-1040, CamoFei, and ChamelGang. Warlock's primary motivation appears to be financially driven ransomware deployment, with targeting patterns suggesting either opportunistic exploitation of exposed SharePoint servers or deliberate tasking focused on Portuguese- and Spanish-speaking regions. The actor has demonstrated advanced capabilities including zero-day exploitation, security tool evasion via BYOVD techniques, and rapid lateral movement to achieve domain-wide ransomware deployment.

TTPs (Tactics, Techniques, Procedures)

Warlock leverages multiple Microsoft SharePoint Server vulnerabilities for initial access (T1190), deploying web shells (T1505.003) to extract ASP.NET machine keys and achieve remote code execution. The actor uses DLL side-loading (T1574.002) for malicious code execution and abuses the vulnerable K7RKScan.sys driver (CVE-2025-1055) in BYOVD attacks (T1068) to disable security software (T1562.001). For C2, Warlock abuses legitimate tools including Velociraptor and Microsoft Visual Studio Code's tunnel feature (T1219). The group downloads payloads from legitimate cloud services like catbox[.]moe and wasabisys[.]com (T1102) and stages ransomware in SYSVOL shares (T1080) for domain-wide deployment. Living-off-the-land techniques are employed for reconnaissance (T1087, T1082) and command execution (T1059). The attack chain culminates in ransomware deployment (T1486) against critical infrastructure targets.

Targets & Patterns

Warlock targets critical infrastructure, government, and education sectors in Portuguese- and Spanish-speaking countries across Europe (Portugal, Spain), Africa, and Latin America. Recent campaigns (past two months as of October 2026) compromised at least four organizations including two critical infrastructure operators (a water utility and telecommunications provider), a regional government body, and a university. The targeting pattern suggests either opportunistic exploitation driven by exposed, vulnerable on-premises SharePoint Server deployments or deliberate tasking with linguistic/geographic focus. The selection of critical infrastructure and government entities indicates potential strategic intelligence collection objectives alongside financial motivation from ransomware deployment. The rapid deployment to 40+ hosts within two hours demonstrates capability and intent to cause maximum operational disruption.

Historical Context

Warlock first gained prominence in mid-2025 through zero-day exploitation of "ToolShell" SharePoint vulnerabilities for ransomware deployment. Earlier in 2026, the group was linked to compromise of SmarterTools by exploiting an unpatched SmarterMail instance. Symantec attributes Warlock activity to overlap with older clusters CL-CRI-1040, CamoFei, and ChamelGang, suggesting continuity of operations under evolving nomenclature. As of July 22, 2026, the actor continues active exploitation of SharePoint vulnerabilities more than a year after initial public disclosure, indicating sustained operational tempo. The group's use of the K7RKScan.sys driver (CVE-2025-1055) for BYOVD attacks mirrors tactics previously employed by DragonForce ransomware operators, suggesting shared tooling or technique adoption across ransomware ecosystems.

Defensive Recommendations

  • Prioritize patching of Microsoft SharePoint Server deployments, particularly addressing ToolShell and related vulnerabilities; implement network segmentation to isolate SharePoint from critical assets (mitigates T1190)
  • Monitor for web shell deployment on SharePoint servers by detecting unexpected .aspx files in SharePoint directories and unusual child processes spawned from w3wp.exe (detects T1505.003)
  • Block or closely monitor the vulnerable K7RKScan.sys driver (CVE-2025-1055) via driver signature enforcement policies and detect BYOVD attempts through Sysmon Event ID 6 (driver load) correlated with security software termination (detects T1068, T1562.001)
  • Restrict and monitor Microsoft Visual Studio Code tunnel feature usage in enterprise environments; detect unauthorized remote access tools via network traffic analysis for VS Code tunnel domains (detects T1219)
  • Implement SYSVOL monitoring for unauthorized file writes and restrict write permissions to domain controllers only; alert on rapid deployment of executables to multiple hosts via Group Policy or domain replication mechanisms (detects T1080, T1486)

---

# Geopolitical Context

Geopolitical Context

The sustained campaign by Warlock—a threat actor assessed to be linked to China and tracked under multiple aliases including Gold Salem, Longlegs, and Storm-2603—represents a strategic targeting pattern focused on Portuguese- and Spanish-speaking regions spanning Europe, Africa, and Latin America. The actor's exploitation of Microsoft SharePoint vulnerabilities to deploy ransomware against critical infrastructure (water utilities, telecommunications), government bodies, and educational institutions suggests either opportunistic exploitation of unpatched systems in these linguistic zones or deliberate tasking aligned with broader strategic intelligence collection or disruption objectives. The group's persistence over 18 months since mid-2025, combined with sophisticated techniques including BYOVD attacks and abuse of legitimate remote access tools, indicates a well-resourced operation with sustained operational tempo. The focus on critical infrastructure operators—particularly water and telecommunications—raises questions about whether ransomware deployment serves primarily financial, disruptive, or pre-positioning purposes within these strategically significant sectors.

State Actor Alignment

Warlock is assessed by industry reporting to have suspected links to China, though no formal government attribution has been publicly issued. The actor's tradecraft—including zero-day exploitation, sophisticated defense evasion via BYOVD techniques, and sustained operational capability—is consistent with state-sponsored or state-adjacent threat activity. The targeting of critical infrastructure and government entities in Portuguese- and Spanish-speaking countries may align with broader Chinese strategic interests in Latin America, Africa, and the Iberian Peninsula, regions where Beijing has expanded economic and diplomatic engagement. However, the ransomware deployment complicates attribution assessment, as financially motivated cybercrime and state-sponsored operations increasingly overlap. No sanctions designations or formal government statements linking Warlock to Chinese state apparatus have been identified in open sources as of October 2026.

Business Impacty pro region

The campaign carries significant implications for European Union member states Portugal and Spain, as well as their linguistic spheres of influence in Latin America and Lusophone Africa. Successful compromise of critical infrastructure operators—including water utilities and telecommunications providers—poses direct risks to public safety, economic continuity, and national security in affected countries. The targeting pattern may exploit lower cybersecurity maturity in some Latin American and African nations compared to North American or Northern European counterparts, while also affecting EU territory directly. For European policymakers, the activity underscores persistent vulnerabilities in on-premises enterprise software deployments and the challenge of securing critical infrastructure against sophisticated threat actors. The cross-regional nature of the campaign—spanning three continents united by language rather than geography—suggests attackers are either exploiting a common vulnerability surface (unpatched SharePoint servers) or conducting intelligence collection across China's areas of strategic interest, including Belt and Road Initiative partner nations and regions with significant Chinese investment in telecommunications and infrastructure.

Forecast

If Portuguese- and Spanish-speaking organizations fail to patch known SharePoint vulnerabilities and implement robust endpoint detection capabilities, Warlock is likely to continue exploiting this initial access vector with sustained success over the coming months. Should the actor's primary objective prove to be ransomware monetization rather than espionage, affected organizations may face increasing extortion demands and potential data leak pressures. Conversely, if the ransomware serves as cover for intelligence collection or network pre-positioning, compromised critical infrastructure entities may face longer-term strategic risks including potential future disruption during geopolitical tensions. If Western governments issue formal attribution linking Warlock to Chinese state interests, the activity may trigger diplomatic responses, sanctions considerations, or inclusion in broader narratives about Chinese cyber operations targeting critical infrastructure. Absent significant improvements in patch management and detection capabilities across the targeted linguistic regions, the campaign is likely to persist through 2026 and potentially expand to additional sectors within the same geographic and linguistic scope.