Warlock Ransomware Exploits Unpatched SharePoint Flaws to Target Critical Infrastructure
Warlock ransomware (Longlegs) continues to breach water utilities, telecoms, governments and universities by exploiting legacy SharePoint vulnerabilities. The attacks highlight the need for robust vulnerability‑management controls and audit‑ready evidence for compliance programs.
ADTP Breach Watch· October 4, 2026· Security Affairs
SeverityHigh
Type🏛️ Ransomware
ConfidenceHigh
ReportedOct 4, 2026
Energy & UtilitiesCritical‑infrastructure utilitiesTelecom service providersGovernment agenciesHigher‑education institutionsVulnerability Exploit
What happened
The Longlegs group used unpatched SharePoint zero‑day flaws to gain initial access, planted webshells, stole ASP.NET machine keys, and deployed ransomware after disabling security tools with a vulnerable signed driver.
Why it matters for trust and compliance
The incident underscores the importance of continuous vulnerability‑management and patch‑verification controls that can be mapped to a single control objective, providing evidence for multiple compliance frameworks.
Demonstrates a control gap in vulnerability management that continuous monitoring can surface and remediate.
Provides audit‑ready evidence of patch status and privileged driver usage for framework‑aligned compliance.
Who is affected
Critical‑infrastructure utilitiesTelecom service providersGovernment agenciesHigher‑education institutions
Recommended actions
Inventory all SharePoint servers and verify they are patched to the latest Microsoft releases.
Enable continuous monitoring of privileged driver installations and capture remediation evidence in a control‑assurance platform.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.