Warlock Ransomware Breaches Organizations via SharePoint, Disabling Security Defenses for Up to 2 Hours
10 Nov 2026
A report from The Hacker News states that Warlock is ransomware that first emerged in attacks in 2025. It is also known as Gold Salem, Longlegs, and Storm-2603. Its latest campaign primarily targets organizations in Spanish- and Portuguese-speaking countries across Europe, Africa, and Latin America.
The targets in this campaign include a strong focus on infrastructure organizations, such as water utilities, telecommunications companies, local government agencies, educational institutions, and universities, representing an expansion of the target scope from previous campaigns.
Exploiting SharePoint Vulnerabilities as an Initial Access Vector
One of the key aspects of the attacks is the exploitation of vulnerabilities in Microsoft SharePoint. In previous campaigns, the attackers exploited a zero-day vulnerability known as ToolShell, but the latest operation has been found to use a wider variety of vulnerabilities and attack tools.
The attackers target on-premises SharePoint servers, which are systems installed and maintained within an organization's own facilities. Once they gain access, they install a Web Shell that supports attacks against multiple SharePoint versions, using it as a channel to carry out various activities within the compromised system.
In addition, the Web Shell is used to collect ASP.NET Machine Keys from the SharePoint Farm. These keys can be used to create properly signed payloads and enable attackers to execute code remotely (Remote Code Execution: RCE) within the SharePoint Application Pool.
Using Multiple Techniques to Evade Security Systems
After gaining access to a victim's network through SharePoint, the attackers continue their operations using multiple techniques to increase their chances of controlling the system and evading detection by security software. The details are as follows:
DLL Sideloading: Malicious DLL files are used with the DLL Sideloading technique to load and execute malware code directly in memory (In-Memory Execution), reducing the likelihood that malicious files will be detected through file scanning on disk.
Using Cloud Services to Download Payloads: Payload files are downloaded from legitimate file-hosting and cloud services, such as catbox[.]moe and wasabisys[.]com, leveraging the trustworthiness of these services to evade detection systems.
BYOVD to Disable Security Systems: The attackers exploit CVE-2025-1055, which is associated with the K7RKScan.sys driver, through the Bring Your Own Vulnerable Driver (BYOVD) technique. They install and use a vulnerable driver on the victim's machine to disable cybersecurity software. The report states that this technique can disable as many as 40 security products and keep them inoperative for up to approximately two hours.
Living-Off-The-Land (LotL): Tools already present within the victim's system are used to gather information and inspect the network environment (System Reconnaissance), as well as to execute the attackers' commands. The tunneling capabilities available in Microsoft Visual Studio Code are used to establish a remote connection channel between the victim's machine and the attackers' system.
Spreading Through SYSVOL: The Warlock ransomware payload is placed in the shared SYSVOL folder, which is part of Active Directory, to distribute the malware to other connected machines within the organization's network. The report states that the attackers successfully carried out this activity in 33 organizations.
Organizations Should Strengthen SharePoint Security
These attacks highlight the risks posed by on-premises SharePoint systems, which can become a major entry point for intrusions into organizational networks if they are not updated or adequately secured.
Organizations using SharePoint should prioritize regularly installing security patches, monitoring servers for abnormal activity, watching for Web Shell installations and the use of unwanted drivers, and reviewing changes within SYSVOL to prevent malware from spreading to other systems.
Source: The Hacker News
Other related
IT News, StreamRat, Malware, CybersecurityStreamRat Malware Warning: Android Malware Spread Through Facebook and TikTok Ads
IT News, Cyber Security, Malware, LinkedInIranian hackers fake job postings on LinkedIn to trick Devs into downloading RAT malware
IT News, Android, Malware, Botnet
