WARLOCK RANSOMWARE HITS LARGE SPANISH, PORTUGUESE ORGS

Summary from the TLDR InfoSec newsletter

Warlock, also tracked as Longlegs and Storm-2603, targeted four Spanish- or Portuguese-speaking organizations within two months: a water utility, telecom provider, regional government, and university. The group exploits Microsoft SharePoint flaws, then uses DLL sideloading, vulnerable drivers, VS Code remote tunnels, and SYSVOL replication to spread ransomware through Active Directory.