security-com · Crawled Nov 14, 2026
Warlock Ransomware Attackers Hit Water and Telecom Operators
21 IoCs 1 Actors 1 Malware
Read original article ↗
AI Summary
The China-nexus threat actor Longlegs (aka Storm-2603), linked to Warlock ransomware, has conducted recent attacks against at least four organizations, including critical infrastructure operators in the water and telecommunications sectors. The group exploits unpatched Microsoft SharePoint vulnerabilities, including the 'ToolShell' exploit chain involving multiple CVEs, to gain initial access and deploy webshells. They use DLL sideloading, living-off-the-land techniques, and abuse of signed vulnerable drivers like K7RKScan (CVE-2025-1055) to disable security software and deploy ransomware across domains via SYSVOL replication. The attackers also leverage Visual Studio Code's tunneling feature for covert remote access and stage payloads on legitimate file-sharing services such as catbox[.]moe and wasabisys[.]com.
AI-extracted · verify before operational use
Extracted Entities 2 found
Indicators of Compromise 21 extracted
| Type | Value | Detail |
|---|---|---|
| Domain | litter[.]catbox[.]moe | Details → |
| Domain | xn8xyt-drop[.]s3[.]wasabisys[.]com | Details → |
| SHA-256 | 116ca4e88a1bcebb6c0da7fb431c8eca7b8ef3f9767194820c56091972ccac2c | Details → |
| SHA-256 | 155fb1cbdaea12c83ba92d18c88cf38bbc42bb684f913ca0bc26fcf115426a55 | Details → |
| SHA-256 | 1edb2c0b537cd95bbd5fc16321b4c38a6adf325ccc7b588ad6acc980b0463b60 | Details → |
| SHA-256 | 206f27ae820783b7755bca89f83a0fe096dbb510018dd65b63fc80bd20c03261 | Details → |
| SHA-256 | 27b7591cf9e1283010ca98fa5dbe970a73fee0d8cde277639924c144718db7c0 | Details → |
| SHA-256 | 37f94fe1b4a106f02b6f74a69cbc05e69c17406f688beef4c9a045ffcbd2e65e | Details → |
| SHA-256 | 6d07f1232dc59b84038fd0b2e75fdd3d5b825882bb0dba9e6724b7b0823fa3ad | Details → |
| SHA-256 | 73c5268256c9da5488cd9e2b79013060ac321c7e54129344dc7b51e268af36ea | Details → |
| SHA-256 | 8b58f7811a2a2f2a5024220490473774f02759dd2dd904b5b9fabfbaae37125f | Details → |
| SHA-256 | 8ce8d8270ee9de02644530b8dd7fa78973b4a3b80f121e2c5f45ae68cce196f9 | Details → |
| SHA-256 | 9ceb01f8bf7d6dba2ae07f5bd6070de3ec67b5eb01f969b0ba85e74564fb83a7 | Details → |
| SHA-256 | aaff04d84ef85353966aa4af186ff1254b72c068f33f802417b29dc23fb9f192 | Details → |
| SHA-256 | ae9f7fce57c7b928e659dccf0e00fa79cd9cd61a106f18d4e03f92dc3a03c295 | Details → |
| SHA-256 | c46825fcc0d1bf7a8b192facb176d6bf916c9dccfd6fa994be691e3b0e585f4e | Details → |
| SHA-256 | e14240bac8277b0f6dd4d29ab5da20d246bcccae647e5fe8d19cdae7fe471b20 | Details → |
| SHA-256 | e3204b05e2f3a29bb6e6fcc21dda77d7cd31dfa755c21da0aa8661b5619ee0a1 | Details → |
| SHA-256 | eea631b5f7125239db0811e4682c2316ead69f9822e02d94fb5d8bf0d2faebed | Details → |
| SHA-256 | f7269f80f81e99d06a590d7ab374e12fdf7e5f55a02c2a46c342d670f8519fdf | Details → |
| SHA-256 | fb3846c9ac53d1b841ada3a6b1091153fea41a169cb44fe0084097d1f4d45984 | Details → |
MITRE ATT&CK TTPs 51 techniques
T1003.001 LSASS Memory · Credential Access T1018 Remote System Discovery · Discovery T1021 Remote Services · Lateral Movement T1021.001 Remote Desktop Protocol · Lateral Movement T1021.003 Distributed Component Object Model · Lateral Movement T1021.004 SSH · Lateral Movement T1046 Network Service Discovery · Discovery T1048 Exfiltration Over Alternative Protocol · Exfiltration T1053 Scheduled Task/Job · Execution T1055 Process Injection · Defense Evasion T1055.001 Dynamic-link Library Injection · Defense Evasion T1055.002 Portable Executable Injection · Defense Evasion T1059.001 PowerShell · Execution T1059.003 Windows Command Shell · Execution T1069 Permission Groups Discovery · Discovery T1069.002 Domain Groups · Discovery T1070 Indicator Removal · Defense Evasion T1070.004 File Deletion · Defense Evasion T1071.001 Web Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1087 Account Discovery · Discovery T1087.002 Domain Account · Discovery T1090 Proxy · Command And Control T1102 Web Service · Command And Control T1105 Ingress Tool Transfer · Command And Control T1110.003 Password Spraying · Credential Access T1111 Multi-Factor Authentication Interception · Credential Access T1133 External Remote Services · Persistence T1190 Exploit Public-Facing Application · Initial Access T1204.001 Malicious Link · Execution T1204.002 Malicious File · Execution T1210 Exploitation of Remote Services · Lateral Movement T1218.001 Compiled HTML File · Defense Evasion T1219 Remote Access Software · Command And Control T1484 Domain or Tenant Policy Modification · Defense Evasion T1485 Data Destruction · Impact T1486 Data Encrypted for Impact · Impact T1526 Cloud Service Discovery · Discovery T1534 Internal Spearphishing · Lateral Movement T1543.003 Windows Service · Persistence T1553 Subvert Trust Controls · Defense Evasion T1558 Steal or Forge Kerberos Tickets · Credential Access T1564.008 Email Hiding Rules · Defense Evasion T1566 Phishing · Initial Access T1567 Exfiltration Over Web Service · Exfiltration T1572 Protocol Tunneling · Command And Control T1621 Multi-Factor Authentication Request Generation · Credential Access T1663 T1663 T1687 T1687