Warlock Ransomware Campaign Exposes Gaps in Utility Cyber Defenses

On Oct. 1, threat researchers reported that the China-linked group associated with Warlock ransomware, tracked by Microsoft as Storm-2603, had attacked at least four organizations during the preceding two months. Victims included a water utility, a telecommunications provider, a regional government body, and a university. The activity spanned Portuguese- and Spanish-speaking countries across Europe, Africa, and Latin America. Researchers identified on-premises Microsoft SharePoint as the likely initial access route, and believe the group continued to use the ToolShell flaws it exploited in July 2025, the same month Microsoft issued fixes, along with newer SharePoint vulnerabilities. The continued value of an exploit against a bug patched more than a year earlier underscores a practical concern for operators: deployed fixes do not protect systems that remain unpatched or exposed.

The reported intrusion at a critical infrastructure operator illustrates how attackers can turn a software foothold into a coordinated disruption. On July 22, the operators planted a web shell on a SharePoint server. Over the following week, they mapped the domain, established covert remote access, and added an account—apparently named to resemble a SharePoint service account—to local administrator groups. For roughly a day, the only recorded activity was a planted code component running in the background. This extended preparation period matters to utility security teams and their government customers: attackers may have time to understand identity and infrastructure dependencies before launching ransomware, so procurement and operations plans should account for detection and response across the entire intrusion timeline.

In the early hours of July 31, the attackers moved to disable defenses and distribute the payload. A tool designed to disable security software was recorded on at least 40 hosts in about two hours. The operators then placed Warlock in the domain’s SYSVOL share, which Windows replicates to every domain controller and makes readable across the domain. Ordinary replication carried the ransomware to at least 33 hosts. Researchers found that on each affected host, the ransomware appeared almost as soon as protection was removed. That sequence—disable security, distribute through normal domain mechanisms, then encrypt—shows why endpoint protection cannot be evaluated solely as a purchased product or license. Utilities need to assess whether controls resist tampering, whether administrators can rapidly detect their removal, and whether identity and directory services can be contained during an incident.

The procurement implication is not to trade away foundational controls, but to make them harder to neutralize and to verify their operational resilience. The source identifies patching and endpoint detection and response (EDR) as essential: patching can close the likely SharePoint entry point, while detection may be the only way a team learns that an intrusion is underway. It also calls for tamper protection and blocking known vulnerable drivers to be enabled everywhere. The incident’s arithmetic—about 40 hosts losing protection in 120 minutes, or an average of one host every three minutes—provides a concrete stress-test scenario for utility security programs. Buyers can use that tempo to evaluate alerting, containment, recovery, and support requirements in EDR and managed security procurements. The source is truncated after noting that a control an adversary can switch off is worth less than a more resilient alternative; it does not provide further recommendations or contract details.

• Storm-2603, the China-linked group behind Warlock ransomware, reportedly attacked at least four organizations in the prior two months.
• Reported victims included a water utility, a telecommunications provider, a regional government body, and a university.
• Researchers say on-premises Microsoft SharePoint was the likely entry point; the group reportedly retained ToolShell flaws exploited in July 2025 and used newer SharePoint flaws.
• In the critical infrastructure intrusion, attackers planted a SharePoint web shell on July 22, then spent about a week mapping the domain and establishing covert access.
• An account apparently named to resemble a SharePoint service account was added to local administrator groups.
• On July 31, a security-disabling tool was recorded on at least 40 hosts within about two hours.
• Warlock was staged in SYSVOL and distributed by normal Windows replication to at least 33 hosts; ransomware appeared after protection was removed.
• The observed pace averaged roughly one host losing protection every three minutes, a useful benchmark for detection and containment exercises.
• The source emphasizes keeping SharePoint patched, maintaining EDR, enabling tamper protection, and blocking known vulnerable drivers; it warns against cutting these foundational defenses to fund other priorities.