Warlock Weaponizes SharePoint Server Flaws and BYOVD to Deploy Ransomware

Unpatched on-premises Microsoft SharePoint Server instances are coming under renewed attack from the suspected China-linked threat actor known as Warlock, who is weaponizing SharePoint vulnerabilities to gain initial access, hijack ASP.NET machine keys, and deploy ransomware across target networks. Tracked under aliases including Longlegs, Gold Salem, and Storm-2603, the group has recently struck critical infrastructure operators, government entities, and higher education institutions across Portuguese- and Spanish-speaking regions in Europe, Africa, and Latin America.

Initial Access and Machine Key Extraction

The campaign relies heavily on exposed, on-premises Microsoft SharePoint Server infrastructure as an entry vector. Attackers exploit SharePoint remote code execution vulnerabilities—including the “ToolShell” flaw chain—to establish a beachhead and drop specialized web shells capable of targeting multiple SharePoint versions.

Once the web shell is active, Warlock’s primary objective inside the web application context is to locate and extract the SharePoint farm’s ASP.NET machine keys (ValidationKey and DecryptionKey). In SharePoint and broader ASP.NET architectures, machine keys are responsible for signing and encrypting ViewState data, authentication cookies, and session state tokens.

By stealing these keys, the threat actors no longer need to re-exploit external vulnerabilities to maintain administrative control. Instead, they can forge arbitrarily signed ViewState payloads from any location. When the SharePoint server receives and deserializes these malicious, validly signed ViewState requests, it executes arbitrary code directly inside the w3wp.exe worker process within the SharePoint application pool context.

Persistent C2 via Cloud Services and VS Code Tunnels

To evade network perimeter defenses during post-exploitation, Warlock avoids traditional, easily blockable command-and-control (C2) infrastructure. Instead, the attackers pull down secondary payloads from public cloud storage and file-sharing providers, specifically catbox[.]moe and wasabisys[.]com. Because outbound connections to legitimate cloud storage domains frequently pass through firewall rules without deep inspection, this staged delivery mechanism effectively masks binary downloads.

For persistent remote management and interactive command execution, Warlock leverages legitimate Microsoft Visual Studio Code (VS Code) CLI tunnel features (code tunnel). By initializing a VS Code tunnel on the compromised SharePoint host, the attackers establish an outbound, encrypted reverse connection over standard HTTPS back to Microsoft’s tunnel infrastructure. This allows them to execute remote commands, conduct reconnaissance, and move laterally across the network without generating suspicious inbound connection logs or relying on custom malware listeners.

Neutralizing Host Defenses and SYSVOL Ransomware Staging

Once inside the internal network, Warlock moves rapidly to neutralize host-based security controls before initiating encryption. To accomplish this, the threat actor employs a Bring Your Own Vulnerable Driver (BYOVD) technique.

The attackers load a legitimate but flawed driver, K7RKScan.sys (tracked under CVE-2025-1055), onto target systems. Because the driver is digitally signed by a recognized vendor, Windows kernel Driver Signature Enforcement (DSE) allows it to load without raising kernel alerts. Warlock then exploits CVE-2025-1055’s memory manipulation primitives to terminate Endpoint Detection and Response (EDR) processes, disable Antimalware Scan Interface (AMSI) hooks, and blind local security agents. This driver was notably utilized in earlier campaigns by DragonForce ransomware operators, highlighting a shared toolset or overlapping playbooks among ransomware affiliates.

With host defenses disarmed, Warlock automates domain-wide ransomware deployment by staging the payload in the domain controller’s SYSVOL share (\\<Domain>\SYSVOL). Because Windows Active Directory automatically replicates SYSVOL contents to all domain controllers and routinely synchronizes login scripts and Group Policy Objects (GPOs) across domain-joined hosts, staging the ransomware binary here turns standard Active Directory replication into a distribution pipeline. In one documented intrusion against a critical infrastructure operator, Warlock pushed its security-disabling tool to at least 40 hosts in under two hours, subsequently deploying the Warlock ransomware binary to 33 hosts via SYSVOL.

Actor Overlaps and Defensive Actions

Threat intelligence analysis from Symantec and Carbon Black attributes this activity cluster to Warlock, noting tactical and infrastructure overlaps with older threat groups tracked as CL-CRI-1040, CamoFei, and ChamelGang. Confirmed targets over the past two months include a municipal water utility operator, a regional telecommunications provider, a regional government administrative body, and a public university. Intrusions observed as recently as July 22, 2026, demonstrate that the group is actively exploiting unpatched SharePoint servers to perform rapid, end-to-end network encryption.

Organizations running on-premises Microsoft SharePoint Server deployments should implement the following defensive controls:

• SharePoint Patching & Key Rotation: Apply all current cumulative updates for on-premises SharePoint Server deployments immediately. If unauthorized read access or web shell activity is suspected on a SharePoint server, rotate the ASP.NET machine keys across the entire farm to invalidate any forged ViewState payloads.
• Driver Blocklisting: Enable Microsoft’s Vulnerable Driver Blocklist via Windows Defender Application Control (WDAC) or Hypervisor-Protected Code Integrity (HVCI) to prevent the loading of known vulnerable drivers, specifically K7RKScan.sys (CVE-2025-1055).
• SYSVOL and Process Monitoring: Monitor the SYSVOL directory (C:\Windows\SYSVOL\sysvol) for unauthorized executable or script staging. Configure alert rules for code.exe or code-tunnel.exe establishing outbound WebSocket connections to Microsoft’s developer tunnel endpoints.
• Egress Control: Restrict direct internet egress from application pool accounts and IIS worker processes, ensuring web servers cannot connect directly to external cloud file-hosting domains like catbox[.]moe and wasabisys[.]com.