An October disclosure with a longer timeline
Symantec and Carbon Black published research on October 1 describing recent Warlock ransomware activity against a water utility, telecommunications provider, regional government body and university. The researchers associate the activity with Longlegs and say the victims were in Portuguese- and Spanish-speaking countries. Their detailed intrusion timeline begins in July; the publication date should not be mistaken for the attack date.
The path beyond the first server
The report describes SharePoint-related access, attempts to disable endpoint protection and ransomware staged in the domain’s SYSVOL area. In one case, researchers observed a security-disabling tool reach at least 40 hosts within about two hours and ransomware on at least 33 hosts. They identify likely SharePoint exploitation in that intrusion, not a conclusively proven single vulnerability for every victim. The findings show how an incident originating on an application server can reach infrastructure with broader administrative influence.
Analysis: recovery needs an authority map
For utilities and telecommunications organizations, our assessment is that a recovery plan should identify the authority needed to restart each service, not only the location of its backup. If the accounts or distribution systems used to rebuild machines are themselves under investigation, a technically successful restoration can leave a difficult trust decision unresolved. That question belongs in exercises before a real outage forces hurried choices. An operations lead should know which customer services depend on each administrative system and which emergency communications remain available if routine collaboration tools cannot be trusted. The security team should know who can authorize isolation. Those responsibilities are particularly important where one MSP operates applications while another team controls identity or networks.
Rehearse a smaller, verifiable restart
A useful exercise is to choose one essential service and walk through its restoration using only the access, documentation and evidence the response team would actually possess. Record the dependencies that require another administrator, another supplier or an unavailable credential. Decide in advance what evidence is needed before reconnecting a recovered system to the wider estate. This is a planning recommendation, not a finding that any particular utility’s safety systems were affected in the reported cases. The immediate management task is to expose assumptions about who can restore what. A recovery timetable that ignores those dependencies may look precise while giving the business little basis for confidence.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
