Longlegs used on-premises SharePoint vulnerabilities for initial access in July 2026, then expanded the intrusion toward ransomware deployment. The activity matters to U.S. administrators because an internet-facing server can give attackers a path into a wider network. Exposure raises concern, but it does not mean every SharePoint environment was affected.
BYOVD is a technique in which an attacker abuses a legitimate but vulnerable driver to interfere with security controls. The term matters because Longlegs has used this method to weaken endpoint defenses. Administrators need to know whether exposed servers are current and whether their systems show signs of follow-on activity.
This report explains the observed campaign and the practical checks that can help teams reduce risk. For U.S. organizations, the immediate question is whether an exposed SharePoint Server is both current and being monitored for post-exploitation activity.
Key Takeaways
- Longlegs used on-premises SharePoint vulnerabilities for initial access in July 2026.
- The recent activity affected four types of organizations across three regions.
- Web shells and unusual IIS activity can point to a server compromise.
- BYOVD can help attackers interfere with endpoint security controls.
- Administrators should check server updates, exposure, and activity after exploitation.
What the Warlock Ransomware SharePoint ToolShell 2026 Campaign Means
The recent campaign affected four different kinds of organizations, not only critical infrastructure operators. In the two months before October 2, 2026, Longlegs, also tracked as Storm-2603, targeted at least four organizations in Portuguese- and Spanish-speaking countries.
The victims included a water utility, a telecommunications provider, a regional government body, and a university. Their locations spanned Europe, Africa, and Latin America, making the pattern broader than one sector or region. The recent targets do not define the reach of Warlock ransomware.
Warlock first appeared publicly on the Russian-language RAMP forum in early June 2025. By August 20, 2025, its known victims spanned North America, Europe, Asia, and Africa. That earlier footprint suggests the group’s reach was already broad.
The language and geography of these victims are a notable pattern, not proof of a single targeting motive.
The Portuguese- and Spanish-speaking focus could reflect opportunistic exposure or deliberate targeting. Neither explanation is established. WaterISAC’s campaign summary describes the reported victim types and regions.
Which SharePoint flaws give Longlegs a way in?
ToolShell is a set of SharePoint flaws, while the reported 2026 CVE-2026-58644 activity is a separate vulnerability to track. These are distinct issues, and the 2025 flaws do not all describe unauthenticated remote code execution. Longlegs has used, or likely retained, CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771.
The 2025 ToolShell vulnerability chain
The flaws include remote code execution and spoofing issues. CVE-2025-53770 is a critical remote code execution flaw with a CVSS score of 9.8. CVE-2025-53771 is a medium-severity spoofing flaw with a CVSS score of 6.3.
| CVE | Reported issue | Specific detail |
|---|---|---|
| CVE-2025-49704 | Remote code execution | ToolShell vulnerability set |
| CVE-2025-49706 | Spoofing | ToolShell vulnerability set |
| CVE-2025-53770 | Remote code execution | Critical, CVSS 9.8 |
| CVE-2025-53771 | Spoofing | CVSS 6.3, improper file-path restriction |
Unit 42’s ToolShell analysis documents web-shell placement and machine-key theft during exploitation.
How web shells turn stolen keys into code execution
Longlegs places web shells in the LAYOUTS directory and harvests ASP.NET machine keys. It can then forge signed payloads that run code in the SharePoint application pool.
CVE-2026-58644 is a separate 2026 vulnerability with a CVSS score of 9.8. Updates came out July 14, exploitation was confirmed July 15, and CISA added it to the Known Exploited Vulnerabilities catalog July 16.
Its reported chain starts with an unauthenticated crafted POST to the ToolPane endpoint and can place spinstall0.aspx in LAYOUTS. A web shell that can use stolen machine keys to run code in the application pool is evidence of a compromised server, not just an unpatched one.
What happens after the SharePoint foothold?
A SharePoint foothold can become a broader network intrusion before any ransomware is visible. In one 2026 intrusion, attackers installed a web shell on July 22, then ran reconnaissance commands on July 24. The early activity gave them a chance to map the victim’s environment.
They carried out domain-account activity and used NetExec for enumeration, credential spraying, and remote execution. Code-execution activity followed on July 28. By July 29, the intrusion had advanced beyond initial access.
Longlegs used DLL sideloading, a method that loads malicious code through a legitimate program’s search for a library file. Attackers also used legitimate cloud-hosting services to deliver follow-on payloads. That traffic can blend with ordinary network use.
Longlegs installed code-insiders.exe as a service to use the Visual Studio Code tunnel feature for covert remote network access. The Visual Studio Code tunnel can resemble expected developer or administrator traffic. A consumer VPN for privacy and speed encrypts traffic between a device and its VPN server, but does not serve the same purpose as this tunnel.
Trend Micro has reported Warlock activity involving Group Policy changes, credential theft, and lateral movement. Attackers used built-in Windows tools and custom malware during that activity. An unexpected code-insiders.exe tunnel service deserves investigation even when its binary is signed by Microsoft.
How does Longlegs disable defenses and spread Warlock?
In one critical-infrastructure intrusion, the defense-evasion phase reached at least 40 hosts in about two hours before Warlock appeared on at least 33. That pace shows how quickly security teams may need to assess activity across multiple systems. The specific vulnerable driver in that intrusion was not identified.
Kernel-level security-process termination
Longlegs has used the signed but vulnerable K7RKScan driver, associated with CVE-2025-1055, to terminate protected security processes at kernel level. This group-level example is separate from the 40-host intrusion. K7RKScan was not confirmed as the driver used in that incident.
BYOVD lets an attacker abuse a legitimate driver with a security flaw. Because the driver can act at kernel level, it may help stop security software that would otherwise detect or block later activity.
SYSVOL staging for network-wide deployment
Attackers staged ransomware in SYSVOL, the domain replication share used by Active Directory. Ordinary domain replication can then distribute files across domain controllers. Microsoft Threat Intelligence identified Storm-2603 as a China-based group that deployed Warlock through Group Policy after gaining access.
SYSVOL replication and Group Policy can help carry a payload across a domain, though not every SYSVOL staging event uses the same deployment method. The share’s normal role makes unexpected files or changes important to review.
Trend Micro has also reported Group Policy modification as part of Warlock activity. A change to policy settings can help attackers reach more systems after gaining credentials. Unexpected vulnerable-driver activity and changes to SYSVOL should be investigated as separate but potentially connected tracks.
Which signs can defenders use to spot the intrusion?
A web shell in a SharePoint LAYOUTS directory is one of the clearest signs to investigate, but defenders should correlate it with server behavior. One filename alone cannot capture every form of exploitation or follow-on access. Look for related files, alerts, and unusual IIS activity together.
SharePoint and IIS indicators
Microsoft identifies creation of spinstall0.aspx in a SharePoint LAYOUTS directory as an indicator of successful post-exploitation associated with CVE-2025-53770. Attackers have used filename variants, so an exact match is not the only signal to check.
Endpoint and network behavior to correlate
Use these four checks to guide detection work:
- Look for spinstall0.aspx in any SharePoint LAYOUTS directory.
- Review suspicious web-shell filename variants and unexpected files in LAYOUTS.
- Check for “Possible web shell installation,” “Possible exploitation of SharePoint server vulnerabilities,” and “Suspicious IIS worker process behavior.”
- Investigate unusual IIS worker-process behavior and connections to litter[.]catbox[.]moe or xn8xyt-drop[.]s3[.]wasabisys[.]com.
These alerts can have unrelated causes, including activity that does not involve a compromise. A missing exact filename does not prove that a server is clean. Treat detection as a matter of context, not a single-file test.
Correlate IIS worker-process alerts with host process and authentication logs before deciding whether the activity is benign.
How should US SharePoint admins reduce exposure?
These ToolShell flaws affect on-premises SharePoint Server, not SharePoint Online in Microsoft 365. Microsoft supports SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition as on-premises versions. Start with the platform before choosing updates or controls.
SharePoint updates are cumulative, and both updates provided for SharePoint 2016 and 2019 should be applied. SharePoint Online is not affected by CVE-2025-53770 or CVE-2025-53771.
| Platform | Affected by CVE-2025-53770 and CVE-2025-53771 | Microsoft-supported on-premises version |
|---|---|---|
| SharePoint Server 2016 | Yes | Yes |
| SharePoint Server 2019 | Yes | Yes |
| SharePoint Server Subscription Edition | Yes | Yes |
| SharePoint Online in Microsoft 365 | No | No |
CISA’s SharePoint guidance advises updates, AMSI, and investigation of potentially compromised systems.
Patch supported on-premises servers and enable AMSI
AMSI integration was enabled by default in the September 2023 security update for SharePoint Server 2016 and 2019. Subscription Edition gained it in the Version 23H2 feature update. Where HTTP request-body scanning is available, use Full Mode with antivirus protection.
Rotate machine keys and restrict unauthenticated access
Follow this five-step checklist:
- Confirm that each SharePoint Server runs a supported version with the latest cumulative updates.
- Apply both applicable SharePoint 2016 and SharePoint 2019 updates.
- Enable AMSI integration and Full Mode where request-body scanning is available, with antivirus protection.
- Run Set-SPMachineKey and Update-SPMachineKey, then run iisreset.exe on every SharePoint server.
- Restrict internet exposure; if AMSI cannot be enabled, disconnect the server or limit unauthenticated traffic through a VPN, proxy, or authentication gateway.
For restricted access, a VPN service comparison can explain consumer VPN features, though enterprise access controls need separate review. Keep internet exposure restricted until the patch, AMSI status, key rotation, and IIS restart have all been verified.
What should an organization do after suspected compromise?
A suspected web shell or security-control shutdown should be handled as a potential wider compromise, not as a routine patch ticket. Containment comes first, while responders preserve enough evidence to understand what happened. Updating software alone does not resolve an active incident.
Trend Micro reported that Warlock encrypts files with the .x2anylock extension and that attackers used RClone for data theft. Those signs were reported in Warlock activity, but are not confirmed in every 2026 victim.
Do not restore affected systems until responders have addressed the entry point and confirmed that usable recovery copies are available.
Coordinate four actions with the incident-response team:
- Activate the organization’s incident-response plan and contain affected hosts.
- Preserve server, endpoint, identity, and network evidence.
- Investigate credential exposure and possible lateral movement.
- Assess possible data theft and recovery options with the response team.
Credential exposure can affect accounts beyond the server itself. A password security and MFA review can support later account protection, but it does not replace an investigation into stolen credentials.
Conclusion
A vulnerable SharePoint server can be the first step in a much wider ransomware incident. An internet-facing SharePoint Server needs both current protection and active verification. Security teams should make exposure checks part of routine operations, rather than relying on a past update alone.
Assign an owner to check patch and exposure status across the organization’s on-premises deployments. That person can track which servers face the internet and whether each has the required safeguards. Assign a named administrator to verify the organization’s exposed SharePoint Server inventory and remediation status.
FAQ
Does SharePoint Online have the same exposure to the 2025 ToolShell flaws?
No, CVE-2025-53770 and CVE-2025-53771 affect on-premises SharePoint Server, not SharePoint Online in Microsoft 365. The two products have different service models, so administrators should identify which one their organization runs. SharePoint Online was not affected by these two flaws. That distinction does not remove the need to review security notices for other products or vulnerabilities.
Does installing a SharePoint update prove that a server was not compromised earlier?
No, installing an update does not show whether attackers gained access before the update. Responders should inspect for web shells, suspicious IIS activity, and signs of stolen machine keys or follow-on access. They should also review authentication and host logs for activity around the suspected intrusion. A patched server may still need a full compromise assessment.
What does the .x2anylock file extension indicate?
The .x2anylock extension was reported on files encrypted by Warlock. Treat it as a ransomware indicator, not proof of the full scope of an incident. Responders should check whether other systems show encryption or suspicious access. The extension alone does not confirm how attackers entered, whether data was stolen, or which systems remain affected.
Can defenders rely on finding spinstall0.aspx to detect every SharePoint web shell?
No, defenders cannot rely on that exact filename to find every web shell. Attackers have used filename variants, so teams should review LAYOUTS directories for unexpected files. Correlate file checks with IIS activity, process behavior, and authentication logs. A clean search for spinstall0.aspx does not prove that a SharePoint server was never compromised.
What does RClone have to do with Warlock?
RClone is a legitimate file-synchronization tool that was reported in Warlock data-exfiltration activity. Its presence alone does not prove that data theft occurred, because organizations may use it for valid work. Check which account ran it, what files it accessed, and whether the network destination fits approved activity. Responders should assess its use alongside other incident evidence.
Is K7RKScan confirmed as the driver used in the 40-host intrusion?
No, the specific vulnerable driver used in the 40-host intrusion was not identified. Longlegs has used the signed but vulnerable K7RKScan driver linked to CVE-2025-1055 in other reported activity. That group-level example does not confirm its use in this incident. Investigators should identify the driver from host evidence rather than assume it was K7RKScan.
