Warlock Ransomware Still Exploits Year-Old SharePoint Flaws to Hit Critical Infrastructure

**Warlock ransomware (attributed to Longlegs/Storm-2603) continues to exploit ToolShell SharePoint flaws to compromise organizations — including water utilities, telecoms, governments, and universities — by deploying webshells, stealing ASP.NET machine keys to run signed payloads, using DLL sideloading and a vulnerable signed driver to disable defenses, and distributing ransomware via SYSVOL replication, resulting in rapid, widespread encryption of dozens of hosts.**