Excerpt
Key findings
Warlock first came to prominence via the exploitation of a Microsoft SharePoint “ToolShell” exploit chain. Warlock is developed by a China-nexus threat actor Symantec calls Longlegs (aka Storm-2603). Symantec has previously tied this group to older activity clusters known as CL-CRI-1040, CamoFei, and ChamelGang.
In the past two months, Longlegs has attacked at least four organizations, including two critical infrastructure operators (a water utility and a telecommunications provider), a regional government body, and a university. Victims were in Portuguese- and Spani…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Symantec on security.com.
Mentioned in the excerpt
More from Symantec4
- Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by SideSymantec · Added 18 Aug
- GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable DefensesSymantec · Added 28 Jul
- Fast16: Pre-Stuxnet Sabotage Tool Was Built to Subvert Nuclear Weapons SimulationsSymantec · Added 23 Jul
- Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New BackdoorSymantec · Added 17 Jul
On the same topics
- JadePuffer Becomes the First Ransomware Campaign to Let an AI Agent Run the Entire Attacksecurereading.com · Added 28 Jul
- AI Security Incident Case: JadePuffer Ransomware Leverages AI Agent to Automate Attacksnsfocusglobal.com · Published 7 Jul
- Nemty 1.6 Ransomware Released and Pushed via RIG Exploit KitBleepingComputer · Published 11 Oct 2019
- Cl0p hacker operating from Russia-Ukraine war front line – exclusiveCybernews · Published 12 Jul 2023
