[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3OwUHuTNUwWXC4N9l3Kes8aWOLq2Ot6shfTrcL4zKyM":3},{"article":4,"iocs":54,"watch_terms":68,"solutions":69,"lesson":162},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"060b4e56-bf49-42a1-8478-ca4985b17255","Warlock ransomware breach SharePoint in water, telecom operator attacks","warlock-ransomware-breach-sharepoint-in-water-telecom-operator-attacks-e611cb","The China-linked ransomware group Warlock targeted a water utility, a telecom provider, a regional government body, and a university by exploiting SharePoint vulnerabilities to gain initial access. [...]","The China-linked ransomware group Warlock has been observed exploiting SharePoint vulnerabilities to gain initial access to critical infrastructure, including a water utility, a telecom provider, a regional government body, and a university. The group, also known as Longlegs, has been active since mid-2025, notably using a chain of zero-day SharePoint vulnerabilities called ToolShell. In some attacks, they deploy tools to disable endpoint protection before deploying the Warlock ransomware.","China-linked Warlock ransomware group targets water, telecom, government, and university sectors.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fwarlock-ransomware-breach-sharepoint-in-water-telecom-operator-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F08\u002F26\u002FMicrosoft-SharePoint.jpg","2026-10-02T18:33:01+00:00","2026-10-02T20:00:26.226714+00:00",9,[17,20,22,24,26,29],{"name":18,"type":19},"Warlock","threat_actor",{"name":21,"type":19},"Longlegs",{"name":23,"type":19},"Linen Typhoon",{"name":25,"type":19},"Violet Typhoon",{"name":27,"type":28},"SharePoint","product",{"name":30,"type":28},"Visual Studio Code Insiders","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":31,"icon":33,"name":34,"slug":35},null,"Ransomware","ransomware",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,61,63,65],{"type":56,"value":57,"context":58},"cve","CVE-2025-49704","Part of the ToolShell exploit chain for SharePoint.",{"type":56,"value":60,"context":58},"CVE-2025-49706",{"type":56,"value":62,"context":58},"CVE-2025-53770",{"type":56,"value":64,"context":58},"CVE-2025-53771",{"type":56,"value":66,"context":67},"CVE-2025-1055","Vulnerability exploited by the K7RKScan driver for BYOVD technique.",[27,30],{"controls":70,"vendors":158},[71,100,129],{"slug":72,"name":73,"problem":74,"products":75},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[76,84,92],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":101,"name":102,"problem":103,"products":104},"patch-management","Automated patch management","Known holes get closed in days, not months.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":130,"name":131,"problem":132,"products":133},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[134,142,150],{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":154,"product_name":155,"url":156,"description":157},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[159],{"slug":135,"name":136,"logo_path":137,"roles":160},[161],"affected",{"slug":163,"title":164,"body":165,"framework_refs":166,"framework_notes":180},"china-linked-warlock-ransomware-exploits-sharepoint-zero-days-in-critical-infrastructure","China-Linked Warlock Ransomware Exploits SharePoint Zero-Days in Critical Infrastructure","The Warlock\u002FLonglegs group leveraged a chained set of zero-day SharePoint vulnerabilities (ToolShell) to breach critical infrastructure organizations including water utilities, telecom providers, and government bodies — sectors where operational disruption carries severe public safety consequences. Because these were zero-days, organizations had no vendor patch to apply at the time of initial exploitation, making layered defenses and rapid detection the primary lines of defense. The attackers also deliberately disabled endpoint protection before deploying ransomware, indicating a sophisticated, multi-stage intrusion methodology designed to blind defenders. This highlights that unpatched or inherently vulnerable internet-facing collaboration platforms represent a high-value attack surface, especially in critical infrastructure where legacy software and delayed patch cycles are common. The combination of zero-day exploitation and endpoint defense evasion underscores the need for defense-in-depth rather than reliance on any single security control.",[167,168,169,170,171,172,173,174,175,176,177,178,179],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","CIS Control 10: Malware Defenses","NIST CSF ID.AM-2: Software platforms and applications inventoried","NIST CSF PR.PT-3: Principle of least functionality","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SP 800-82: Guide to ICS\u002FOT Security","NIST CSF DE.CM-1: Network monitoring for attack detection","CISA Critical Infrastructure Security: Zero-Trust Architecture guidance","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of technical vulnerabilities","ITIL Problem Management: Root cause analysis and emergency change procedures","NERC CIP-007: Systems Security Management (applicable to energy\u002Fwater sectors)",{"CIS Control 10: Malware Defenses":181,"NIST SP 800-82: Guide to ICS\u002FOT Security":182,"CIS Control 13: Network Monitoring and Defense":183,"CIS Control 12: Network Infrastructure Management":184,"CIS Control 7: Continuous Vulnerability Management":185,"NIST CSF PR.PT-3: Principle of least functionality":186,"NIST CSF DE.CM-1: Network monitoring for attack detection":187,"NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management":188,"NIST CSF ID.AM-2: Software platforms and applications inventoried":189,"CISA Critical Infrastructure Security: Zero-Trust Architecture guidance":190,"ISO\u002FIEC 27001:2022 Annex A 8.8: Management of technical vulnerabilities":191,"ITIL Problem Management: Root cause analysis and emergency change procedures":192,"NERC CIP-007: Systems Security Management (applicable to energy\u002Fwater sectors)":193},"Malware defences on servers can detect web shells and Warlock ransomware payloads dropped after the SharePoint compromise.","Covers isolating OT networks from IT systems like SharePoint, so a breach there cannot reach water or telecom control systems.","Network monitoring can detect exploitation and web shell traffic on SharePoint servers before ransomware deploys.","Limiting exposure of on-premises SharePoint to the internet narrows the attack surface for ToolShell exploitation.","With zero-days, patch management means applying emergency fixes and mitigations the moment SharePoint updates and guidance are released.","Least functionality means disabling unneeded SharePoint features and exposure, reducing what zero-days can reach.","Monitoring networks for attack activity helps catch the exploitation and lateral movement that preceded the ransomware.","Guides fast, prioritised patching, so SharePoint fixes are applied quickly once released for an actively exploited flaw.","An application inventory shows which on-premises SharePoint servers exist and need emergency mitigation.","Zero trust limits what an attacker can reach after compromising one server such as SharePoint.","Requires prompt handling of technical vulnerabilities, including emergency mitigations for exploited SharePoint zero-days.","Emergency change procedures let teams apply out-of-band SharePoint fixes quickly without waiting for routine release cycles.","Requires security patch and port management for critical systems, relevant to utilities exposed through SharePoint servers."]