PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWarlock ransomware attackers are using vulnerable, on-premises SharePoint Server systems as an entry point, then moving into the wider Windows domain. In a report published October 1, 2026, Symantec’s Threat Hunter Team said the China-nexus actor it calls Longlegs (also tracked as Storm-2603) had attacked at least four organizations during the preceding two months. The victims included a water utility, a telecommunications provider, a regional government body and a university in Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America. The organizations were not named.
SecurityWeek’s October 2 coverage summarizes the findings. The practical lesson is broader than installing a SharePoint update: operators must patch supported servers, rotate potentially stolen ASP.NET machine keys, restart IIS, and investigate the domain for persistence, credential theft, security-tool tampering and ransomware deployment.
As an Amazon Associate I earn from qualifying purchases.
What Symantec reported in October 2026
Symantec says Longlegs has continued targeting SharePoint-related vulnerabilities for initial access. Its recent victims included two critical-infrastructure operators, making the activity significant even though the report does not identify the organizations or provide a campaign-wide victim count.
| Reported measure | What it means |
|---|---|
| At least four organizations | Victims reported by Symantec during the two months before its October 1, 2026 report; this is not a prevalence estimate. |
| Two critical-infrastructure organizations | A water utility and a telecommunications provider were among those four victims. |
| At least 40 hosts | Reached by a tool intended to disable security software in about two hours during one intrusion. |
| At least 33 hosts | On which Warlock ransomware was observed in that same intrusion. |
The 40-host and 33-host figures describe one incident, not all Longlegs operations. Symantec also says the group’s recent concentration on Portuguese- and Spanish-speaking countries could reflect opportunistic targeting of exposed servers or deliberate tasking; the available reporting does not establish which explanation is correct.
#1 Best Overall
Symantec links Longlegs to earlier activity clusters identified as CL-CRI-1040, CamoFei and ChamelGang. It describes the actor as China-nexus. Microsoft’s 2025 assessment calls Storm-2603 China-based with moderate confidence and explicitly says it has not identified links to other known Chinese threat actors. Neither description establishes a definitive state-sponsorship finding.
How the SharePoint-to-Warlock attack chain works
1. Initial access is an on-premises SharePoint problem
The affected technology is SharePoint Server running in an organization’s own environment. Microsoft’s 2025 guidance states that the vulnerabilities under discussion affected on-premises servers and did not affect SharePoint Online in Microsoft 365. A Microsoft 365 tenant should not be treated as equivalent to an exposed SharePoint Server farm.
Symantec observed a webshell placed in SharePoint’s LAYOUTS directory. It also described theft of ASP.NET machine keys and use of a forged signed payload to obtain remote code execution in the SharePoint application pool. The October 2026 report does not map a particular newer CVE to each victim, so it is not accurate to claim that every listed SharePoint vulnerability was used in every intrusion.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →2. The foothold is extended beyond the web server
After gaining access, Symantec observed several methods for maintaining access and reaching other systems:
- DLL sideloading and retrieval of payloads from legitimate file-sharing or storage services.
- Abuse of Visual Studio Code’s tunnel feature to create remote access.
- Credential and domain reconnaissance.
- Disabling of security software, including a tool that reached at least 40 hosts in one incident.
- Ransomware staging in
SYSVOLfor broad deployment.
Microsoft’s July 2025 investigation of Storm-2603 activity provides related context, including malicious ToolPane POST requests, webshells with names resembling spinstall0.aspx, credential theft, lateral movement and Group Policy changes used to distribute Warlock. Those observations are earlier vendor reporting and should not be assumed to describe every 2026 victim.
3. Domain-wide impact can follow a single SharePoint compromise
A SharePoint server is often connected to Active Directory, privileged service accounts, administrative tooling and shared file systems. Once attackers steal credentials or establish a route into the domain, they can tamper with endpoint defenses, change Group Policy and distribute ransomware. Symantec’s observation of Warlock staged through SYSVOL illustrates why checking only the original web server is insufficient.
Rank #4
What defenders should do now
- Identify every exposed SharePoint Server. Inventory internet-facing farms, confirm that each runs a supported version, and apply the latest security updates. Microsoft says customers should apply the updates immediately; its guidance is available in Microsoft’s SharePoint vulnerability investigation.
- Do not equate patching with a clean environment. Preserve relevant evidence and begin an incident investigation even after updates install. A patch closes the vulnerable entry point but does not remove a webshell, undo stolen keys or invalidate credentials already taken.
- Rotate ASP.NET machine keys and restart IIS. Microsoft’s response guidance recommends rotating the keys because attackers may have stolen them, then restarting IIS so the application uses the new material. Coordinate the change with application owners and document the restart.
- Verify defensive controls. Microsoft recommends supported SharePoint Server versions with current security updates, Antimalware Scan Interface (AMSI) enabled in Full Mode with Microsoft Defender Antivirus or an equivalent, and Microsoft Defender for Endpoint or equivalent monitoring.
- Search the SharePoint and IIS environment. Look for unexpected files in
LAYOUTS, webshell behavior, suspiciousToolPanerequests, unexplained application-pool execution and changes that cannot be tied to an administrator. Review the web server’s accounts, scheduled tasks and IIS persistence points. - Expand hunting to the domain. Check for credential theft, newly created or modified accounts, lateral movement, Group Policy changes, suspicious activity in
SYSVOL, Visual Studio Code tunnels, DLL sideloading and payload downloads from storage services. - Investigate endpoint tampering. Determine whether security software was disabled or exclusions were added. Isolate affected hosts and involve the organization’s incident-response team when tampering, ransomware execution or privileged-account compromise is suspected.
- Reset privileged credentials when compromise is possible. Perform resets from a trusted process, after containment planning, and include service accounts and other credentials that may have been exposed through the SharePoint server or domain.
- Recover only from a verified-clean state. Microsoft Security Intelligence recommends containment, review of scheduled tasks and Group Policy, and recovery from offline or immutable backups only after the environment has been checked for persistence. Its WarLock reference is at Microsoft’s WarLock threat description.
Detection material and its limits
CISA published malware analysis and detection signatures on August 6, 2025 for files associated with CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771. The analysis covered six files: two DLLs, one cryptographic key stealer and three web shells. Organizations can use those indicators as historical ToolShell-related detection material through CISA’s malware analysis notice, while checking current Microsoft advisories for today’s patch and vulnerability status.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Indicators should be treated as starting points, not proof that a system is safe when no matching file is found. Attackers can remove webshells, alter filenames, use legitimate administration tools or operate through stolen credentials. Detection therefore needs both SharePoint-specific review and domain-wide telemetry.
Patch status and compromise status are separate decisions
| Operational state | What it establishes | What remains necessary |
|---|---|---|
| Internet-facing, unsupported or unpatched SharePoint Server | The server remains exposed to known or related exploitation routes. | Patch or upgrade immediately, restrict exposure where possible, and start an investigation. |
| Supported server with current updates | The known vulnerable entry point has been addressed. | Rotate machine keys, restart IIS and hunt for existing webshells, persistence and stolen credentials. |
| Patched server with no SharePoint indicators | No evidence found in the checks performed. | Continue domain-wide review for credential theft, Group Policy changes, SYSVOL staging and endpoint tampering. |
| Confirmed or suspected compromise | Attackers may have access beyond SharePoint. | Contain hosts, reset privileged credentials, use incident-response expertise and recover only from verified-clean backups. |
An endpoint-security product, a subscription or a detection signature does not substitute for patching, key rotation or incident response. Conversely, patching alone cannot prove that an attacker who entered earlier has been removed.
What is still unknown
- Symantec has not named the four recent victim organizations.
- The October 2026 reporting does not provide a population-level statistic for how common these attacks are.
- The newer SharePoint flaws mentioned in the coverage are not assigned to individual victim intrusions.
- The available evidence does not resolve whether the geographic focus is opportunistic or directed.
Symantec’s October 1 report, “Warlock Ransomware Attackers Hit Water and Telecom Operators,” says that continued activity more than a year after Warlock first became prominent shows that unpatched SharePoint deployments remain a viable initial-access route. For operators, the actionable conclusion is clear: update the server, invalidate secrets that may have been stolen, and verify the entire identity and endpoint environment rather than treating the SharePoint patch as the end of the incident.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
