October 3, 2026
- Warlock ransomware is still getting in through SharePoint, a year after ToolShell. Symantec tracks the China-nexus developer as Longlegs (aka Storm-2603, previously tied to CL-CRI-1040, CamoFei and ChamelGang), and reports at least four victims in the past two months across Portuguese- and Spanish-speaking countries in Europe, Africa and Latin America: a water utility, a telecoms provider, a regional government body and a university. In one critical-infrastructure intrusion the operators pushed a security-software killer to 40+ hosts in about two hours, then deployed Warlock on at least 33 hosts by staging it in the domain SYSVOL share and letting normal domain replication do the distribution. Tradecraft includes the vulnerable signed K7RKScan driver for EDR removal and Visual Studio Code tunnels for covert remote access (Symantec, The Record). · Threat Activity & Malware
in NetScaler Round Two: Patched Appliances Crashing Again as a New SAML Bug Gets Reproduced