Warlock Intrusion Shows Why Security Must Survive Disabled Sensors
Summary
Researchers described a Warlock intrusion in which attackers disabled security tools across dozens of hosts before deploying ransomware. The article argues for protections that act on-device and remain effective when monitoring fails.
Key points
- Researchers reported that the China-linked group behind Warlock ransomware, tracked by Microsoft as Storm-2603, targeted at least four organizations in two months.
- Researchers believe the group used on-premises SharePoint vulnerabilities, including previously exploited ToolShell flaws, alongside newer flaws.
- In one critical-infrastructure intrusion, attackers planted a SharePoint web shell on July 22 and later disabled security software on at least 40 hosts in about two hours.
- Attackers staged Warlock in SYSVOL, where Windows replication carried it to at least 33 hosts; researchers found ransomware appearing soon after protection was disabled.
- The article recommends patching, endpoint detection and response, tamper protection, and blocking known vulnerable drivers, while noting that a vulnerable signed driver can disable security software.
- It advises boards to distinguish protections dependent on sensors and human response from controls that act on the machine, and to record monitoring gaps in the risk register.
Article Details
- Topic
- Warlock ransomware attacks and the disabling of security tools before payload deployment
MITRE ATT&CK
T1098.007 · Additional Local or Domain GroupsThe attackers added an account to local administrator groups.T1486 · Data Encrypted for ImpactThe attackers deployed Warlock ransomware across hosts.T1505.003 · Web ShellThe attackers planted a web shell on a SharePoint server.T1562.001 · Disable or Modify ToolsThe attackers used a tool to disable security software before deploying Warlock.