A China-linked group that Symantec calls Longlegs (also tracked as Storm-2603) is breaking into
unpatched, self-hosted Microsoft SharePoint servers and deploying Warlock ransomware. Recent
victims include a water utility, a telecom provider, a regional government body, and a university; in one
attack the group switched off security tools on 40 machines and encrypted at least 33 within nine days
of first access. Organisations running their own SharePoint servers should apply Microsoft’s security
updates, change the server’s encryption keys, and check for signs of intrusion now.
1. Campaign Timeline
Symantec’s Threat Hunter Team documented a nine-day intrusion at a critical infrastructure operator. Attackers planted a
SharePoint webshell on 22 July 2026, ran domain reconnaissance on 24 July, and on 27 July tested outbound access
through a Burp Collaborator (oastify.com) subdomain containing the victim’s own domain name. MSI payloads arrived on
28 July, followed by a disguised admin account and a VS Code tunnel on 29 to 30 July. In the early hours of 31 July, an
AV/EDR killer spread to 40+ hosts in about two hours, and Warlock ransomware followed on at least 33 hosts.
2. Targeting Profile
In the past two months, Longlegs (aka Storm-2603) attacked at least four organisations: a water utility, a
telecommunications provider, a regional government body, and a university, all in Portuguese- and Spanish
speaking countries across Europe, Africa, and Latin America. Symantec describes the group as China-nexus and
has previously tied it to the CL-CRI-1040, CamoFei, and ChamelGang clusters. Symantec says the language
focus suggests either an opportunistic targeting pattern or more deliberate tasking. Victim names were not
disclosed.
3. Attack Chain
Exploited flaws: the SharePoint ToolShell chain, CVE-2025-53770 (CVSS 9.8), CVE-2025-49704 (CVSS 8.8), CVE-2025
49706 (CVSS 6.5), and CVE-2025-53771 (CVSS 6.5), plus CVE-2025-1055 (CVSS 5.6) in the K7RKScan driver.Detection signal: PowerShell writing new .aspx files into the SharePoint LAYOUTS folder, and the SharePoint worker
process (w3wp.exe) launching cmd.exe or powershell.exe.
- Initial Access: Attackers exploited on-premises SharePoint Server and used PowerShell to write a Base64-encoded webshell, layout2sp.aspx, into the LAYOUTS directory. The webshell harvests the farm’s ASP.NET machine keys for remote code execution.
- Discovery: Attackers ran net user /domain, whoami, and nltest /domain_trusts, then deployed NetExec (nxc.exe) for Active Directory enumeration, credential spraying, and remote command execution.
- Execution and Staging: msiexec /q /i pulled MSI packages from litter.catbox.moe and Wasabi S3 buckets. ssvagent.exe and logger.exe were dropped with gsdll64.dll and doexeloc.dll for DLL sideloading.
- Persistence: Attackers added SPSEPRDSetup, a name mimicking SharePoint setup accounts, to local Administrators, and
- installed code-insiders.exe from C:\Windows\debug as a VS Code tunnel service for covert remote access.
- Defence Evasion: a.exe was copied from a network share named av into C:\Users\Public and run across 40+ hosts. It abuses the signed but vulnerable K7RKScan driver (CVE-2025-1055) to kill protected security processes at kernel level.
- Impact:Warlock binaries run.exe and rune.exe were staged in SYSVOL<domain>\scripts\run, which replicates to every domain controller, then copied to C:\Users\Public and executed on at least 33 hosts, leaving the note how to restore your files.txt.
4. Adversary Toolkit
| TOOL / INDICATOR | TYPE | FUNCTION |
| run.exe / rune.exe | Windows executable | Warlock ransomware binaries staged in SYSVOL and run from C:\Users\Public. |
| a.exe | Windows executable | AV/EDR killer that loads the K7RKScan driver to terminate security processes. |
| K7RKScan driver (CVE-2025-1055) | Kernel driver (signed, vulnerable) | Bring-your-own-vulnerable-driver used to end protected processes at kernel level. |
| layout2sp.aspx | ASP.NET webshell | Dropped in SharePoint LAYOUTS to steal machine keys and run commands. |
| nxc.exe (NetExec) | Python (open-source framework) | Active Directory enumeration, credential spraying, and remote command execution. |
| code-insiders.exe | VS Code Insiders (legitimate) | Installed as a tunnel service for covert remote access. |
| ssvagent.exe, logger.exe, gsd1164.dll, deoxellc.dll | Windows executables and DLLs | DLL sideloading pairs used to run malicious code under legitimate-looking binaries. |
5. Indicators of Compromise (IOCs)
https://www.virustotal.com/gui/collection/d9c5dc025e2feb58633a56e030c992f721321cd25c17e5f6d7b146313c63c690/iocs
6. Recommendations
- Check on-premises SharePoint servers for unknown .aspx files in the LAYOUTS folder (such as layout2sp.aspx), w3wp.exe launching cmd.exe or powershell.exe, and new executables under SYSVOL\scripts.
- Remove attacker footholds: uninstall code-insiders.exe tunnel services, remove unknown accounts such as SPSEPRDSetup from local Administrators, and enable the Microsoft vulnerable driver blocklist to stop K7RKScan.
- Apply Microsoft’s SharePoint updates for CVE-2025-53770, CVE-2025-53771, CVE-2025-49704, and CVE 2025-49706, then rotate the ASP.NET machine keys, restart IIS, and enable AMSI integration in SharePoint.
- Alert on msiexec installing packages from remote URLs, and block outbound traffic to *.oastify[.]com, litter.catbox[.]moe, and *.wasabisys[.]com where there is no business need.
- Block the IOCs at their respective controls, https://www.virustotal.com/gui/collection/d9c5dc025e2feb58633a56e030c992f721321cd25c17e5f6d7b146313c63c690/iocs
7. Sources
- https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure
- https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of
on-premises-sharepoint-vulnerabilities - https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-explo
itation-sharepoint-vulnerabilities
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.