SharePoint attacks spread Warlock ransomware across essential-service networks

A threat actor exploiting Microsoft SharePoint Server compromised at least four organizations over the past two months, including a water utility and a telecommunications provider, according to Symantec research reported by Cybersecurity News. The victims also included a regional government body and a university across Europe, Africa and Latin America. The operator, tracked by Symantec as Longlegs, extracts cryptographic keys from SharePoint to forge requests that execute code. In one intrusion, attackers distributed ransomware through SYSVOL, a shared directory that replicates across domain controllers, reaching at least 33 systems. They also abused Visual Studio Code tunnels for covert access. Investigators did not conclusively identify the vulnerable driver used to disable security tools in that intrusion.