Microsoft 365 threat report

China-based Warlock ransomware group, tracked as Longlegs and Storm-2603, has been actively exploiting SharePoint vulnerabilities since July 2025 against critical infrastructure, government, and education entities. Symantec reports the group continues to target SharePoint servers as part of ongoing ransomware operations.

• Warlock Expands SharePoint Exploitation in Critical Infrastructu(opens in a new tab)
• Warlock Exploits SharePoint Flaws to Disable Security Tools and (opens in a new tab)