Longlegs and Storm-2603 keep breaching unpatched SharePoint servers to plant Warlock ransomware.
Symantec documents attackers abusing signed node.exe to run JavaScript payloads in intrusions since February.
Symantec discovered Spirals, a Rust-based ransomware that encrypted an IT services company's network in less than a day.