Warlock Ransomware Exploiting SharePoint Flaws to Attack Water and Telecom Operators

Symantec/Microsoft-tracked China-nexus actor (Longlegs / Storm-2603) is actively exploiting SharePoint Server vulnerabilities (ToolShell chain and subsequent CVEs) to deploy Warlock ransomware across essential-service and public-sector organizations in multiple regions; techniques include ASPX webshells, forging ASP.NET VIEWSTATE, DLL sideloading, use of signed-but-vulnerable drivers to disable AV/EDR, and domain-wide payload distribution via SYSVOL replication, with multiple file and network IOCs provided.