Warlock Ransomware Targets Critical Infrastructure via SharePoint

Executive Summary

A China-affiliated ransomware group known as Warlock has been actively targeting critical infrastructure and other sectors by exploiting a known, year-old set of vulnerabilities in on-premises Microsoft SharePoint servers. According to research from Symantec, the campaign compromised a water utility, a telecommunications provider, a regional government, and a university. The attacks underscore the persistent risk posed by unpatched systems, even when fixes have long been available. The group, also tracked as Longlegs and Storm-2603, employs sophisticated tactics post-exploitation, including disabling security tools before deploying ransomware to maximize impact.

Threat Overview

The campaign leverages a chain of four SharePoint vulnerabilities collectively dubbed "ToolShell" (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771). These flaws, first used by Warlock in 2025, allow for initial access to vulnerable on-premises servers. The victimology indicates a focus on Spanish and Portuguese-speaking countries in Europe, Africa, and Latin America.

Once inside a network, the threat actors move swiftly. In one observed intrusion against a critical infrastructure operator in late July 2026, the attackers disabled endpoint security on dozens of hosts. They then used the domain's SYSVOL share to stage and distribute the Warlock ransomware, ensuring rapid propagation through standard domain replication. This methodology, combined with their use of "bring your own vulnerable driver" (BYOVD) techniques to blindside defenses, demonstrates a high level of operational maturity.

Technical Analysis

The attack chain begins with the exploitation of the ToolShell vulnerabilities in Microsoft SharePoint. These vulnerabilities likely allow for remote code execution on the server.

Post-Exploitation TTPs

1. Initial Access: Exploitation of ToolShell vulnerabilities (T1190 - Exploit Public-Facing Application).
2. Persistence: Deployment of a web shell compatible with multiple SharePoint versions (T1505.003 - Server Software Component: Web Shell).
3. Defense Evasion: Use of a custom tool to disable endpoint security software. This often involves a BYOVD technique (T1562.001 - Impair Defenses: Disable or Modify Tools) where a legitimate, but vulnerable, driver is used to gain kernel-level access and terminate security processes.
4. Lateral Movement & Impact: The ransomware payload is placed in the SYSVOL directory on a domain controller. This is a highly effective technique for lateral distribution, as Group Policy can automatically push files from SYSVOL to all domain-joined computers (T1021.002 - Remote Services: SMB/Windows Admin Shares).
5. Impact: Deployment of Warlock ransomware to encrypt files on at least 33 hosts within hours of the initial breach (T1486 - Data Encrypted for Impact).

Impact Assessment

The targeting of critical infrastructure, including a water utility and a telecommunications provider, makes this campaign particularly dangerous. A successful ransomware attack on these entities can lead to significant public disruption, impacting essential services, communication networks, and public safety. For the affected university and government body, the impact includes data loss, operational downtime, and potential theft of sensitive research or citizen data. The financial costs of recovery, remediation, and potential ransom payments are substantial. The success of this campaign, relying on year-old vulnerabilities, serves as a stark reminder of the consequences of inadequate patch management programs.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) such as IP addresses, domains, or file hashes were mentioned in the source articles.

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns to identify vulnerable systems or related activity:

Detection & Response

1. Web Shell Detection: Monitor SharePoint server processes (w3wp.exe) for anomalous child process creation. Use file integrity monitoring on SharePoint directories to detect the creation of unexpected .aspx or .php files. This is a form of D3-FA - File Analysis.
2. BYOVD Detection: Monitor for the loading of known-vulnerable drivers. EDR solutions with kernel-level visibility can alert on processes that attempt to terminate security agents. Also, monitor for the creation of suspicious services that load these drivers.
3. SYSVOL Monitoring: Create high-fidelity alerts for any executable file being written to the SYSVOL share, especially by accounts or processes that do not normally perform this action. This is a critical choke point for this attack chain.
4. Network Traffic Analysis: Analyze traffic from SharePoint servers to internal hosts. A compromised SharePoint server initiating numerous SMB connections to workstations is a strong indicator of lateral movement. This involves D3-NTA - Network Traffic Analysis.

Mitigation

1. Patch SharePoint Servers: The most critical mitigation is to apply the security patches for the ToolShell vulnerabilities (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771). Prioritize all internet-facing SharePoint servers. This aligns with D3-SU - Software Update.
2. Harden Group Policy: Implement a GPO to restrict write permissions to the SYSVOL share to only authorized Domain Admins. This can prevent attackers from using it as a distribution point.
3. Application Control: Use application control solutions like AppLocker or WDAC to block the execution of unauthorized executables from locations like the SYSVOL scripts folder. This is a form of D3-EAL - Executable Allowlisting.
4. Driver Blocklisting: Enable memory integrity (HVCI) and use Windows Defender Application Control (WDAC) policies to block known vulnerable drivers from being loaded, which directly counters BYOVD techniques.