Warlock Ransomware Targets Critical Infrastructure via SharePoint Exploits
The China-linked ransomware group Warlock has been observed targeting water utilities, telecommunications providers, regional government bodies, and universities by exploiting vulnerabilities in Microsoft SharePoint to gain initial access. Over the past two months, the threat actor has focused its campaigns on countries where Portuguese and Spanish are spoken, spanning Europe, Africa, and Latin America.
Emergence and ToolShell Exploit Chain
Warlock emerged in June 2025 and gained notoriety a month later after leveraging a chain of four zero-day vulnerabilities in Microsoft SharePoint, collectively known as ToolShell. These vulnerabilities are tracked as CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771. By August 2025, Microsoft reported that state-backed hacking groups Linen Typhoon and Violet Typhoon were also observed using ToolShell exploits, alongside a ransomware actor tracked as Storm-2603.
Symantec Links Warlock to Longlegs and Details Attack Tactics
Cybersecurity firm Symantec identifies Warlock as the same threat actor tracked as Longlegs and attributes the development of the Warlock ransomware to this group. In one intrusion beginning on July 22, 2025, the attackers deployed a tool that disabled endpoint protection software on at least 40 hosts within approximately two hours. Following this, Warlock ransomware was launched on at least 33 of those systems.
Initial Access via On-Premises SharePoint and Web Shell Deployment
After gaining access—typically by exploiting vulnerabilities in on-premises SharePoint deployments—the threat actor drops a web shell designed to function across multiple SharePoint versions. This web shell serves as a persistent backdoor for further operations within the compromised environment.
AV/EDR Killer Deployed via BYOVD Using Vulnerable Driver
Symantec and Carbon Black researchers confirmed that in some attacks attributed to Longlegs, the AV/EDR-killing tool was delivered using the "bring your own vulnerable driver" (BYOVD) technique. This involved abusing a signed K7RKScan driver that is vulnerable to CVE-2025-1055 to gain kernel-level execution and disable security defenses.
Reconnaissance and Artifact Cleanup
Analysis of the July 22 intrusion showed that two days after initial access, the threat actor conducted reconnaissance activities and deleted what appeared to be staging artifacts, likely to reduce forensic visibility and hinder incident response efforts.
Ransomware Staging via SYSVOL and VS Code Tunneling Abuse
The Warlock ransomware payload was staged in the domain’s SYSVOL share—a directory replicated across all domain controllers that stores public files and is commonly used for logon scripts and Group Policy execution. This technique allows attackers to deploy payloads network-wide upon user login or policy refresh, rather than targeting individual hosts sequentially.
Misuse of Legitimate Tools for Lateral Movement
During the attack, the main executable for Visual Studio Code Insiders was installed as a service to abuse its built-in tunneling capability, enabling stealthy remote access to compromised machines. On one system, researchers detected the open-source penetration testing framework NetExec (formerly known as nxc), which facilitated Active Directory enumeration, credential spraying, and remote command execution.
Ransomware Execution Follows Rapid Defense Evasion
The final stage of the attack unfolded on July 31, 2025, after the AV/EDR killer was deployed. Researchers observed that Warlock ransomware appeared almost immediately after protection was disabled on each host, indicating a tightly coordinated sequence of defense evasion followed by encryption.
Ongoing Threat and IOCs Released
Symantec and Carbon Black warn that ToolShell and other SharePoint vulnerabilities remain viable initial access vectors, more than a year after Warlock first emerged exploiting these flaws. The joint threat hunting report includes indicators of compromise (IOCs) for files and infrastructure used in the attacks to aid detection and mitigation efforts.
Source: BleepingComputer