A Chinese ransomware outfit is exploiting Microsoft technologies to extort large and critical organizations in the Spanish- and Portuguese-speaking world.
The Warlock ransomware group — tracked by Symantec as "Longlegs" and by Microsoft as "Storm-2603" — has never fit neatly into any box. It surfaced in the summer of 2025, in a campaign that mirrored state-level espionage activity in its tactics, techniques, and procedures (TTPs). Yet it acted like a cybercrime gang, deploying ransomware against organizations without any apparent discrimination.
Recently, Warlock has devised another curveball. According to research from Symantec this week, it's been entirely focused on countries for which Spanish or Portuguese are the lingua franca. Like its step-brethren in espionage, it's also targeting fewer, more valuable targets. In the last two months, researchers observed Warlock attacks against four victims: a water utility, a telecommunications provider, a regional government body, and a university.