Warlock ransomware breach SharePoint in water, telecom operator attacks

The Warlock/Longlegs group leveraged a chained set of zero-day SharePoint vulnerabilities (ToolShell) to breach critical infrastructure organizations including water utilities, telecom providers, and government bodies — sectors where operational disruption carries severe public safety consequences. Because these were zero-days, organizations had no vendor patch to apply at the time of initial exploitation, making layered defenses and rapid detection the primary lines of defense. The attackers also deliberately disabled endpoint protection before deploying ransomware, indicating a sophisticated, multi-stage intrusion methodology designed to blind defenders. This highlights that unpatched or inherently vulnerable internet-facing collaboration platforms represent a high-value attack surface, especially in critical infrastructure where legacy software and delayed patch cycles are common. The combination of zero-day exploitation and endpoint defense evasion underscores the need for defense-in-depth rather than reliance on any single security control.