Warlock Ransomware Expands Its Attack Chain With Tunnels and Vulnerable-Driver Abuse
Summary
Trend Micro details Warlock’s use of compromised SharePoint servers, web shells, remote-access and tunneling tools, DCSync, and a vulnerable NSec driver to evade security controls, exfiltrate data, and deploy ransomware across victim networks.
Key points
- In an incident observed in January 2026, Warlock operators spent 15 days inside a victim network before deploying ransomware; SharePoint vulnerabilities remained an initial access route.
- The group used a web shell, TightVNC, PsExec, PowerShell Remoting, and RDP modifications for persistence and lateral movement, and obtained domain-level control.
- Warlock expanded its command-and-control options with Velociraptor, VS Code tunnels, Cloudflare Tunnel, and Yuze reverse SOCKS5 proxies.
- A customized loader exploited the vulnerable NSecKrnl.sys driver to terminate security processes at kernel level; Group Policy helped distribute the tool across the domain.
- The attackers used DCSync for credential access and renamed Rclone to exfiltrate files to an attacker-controlled S3 bucket.
- Ransomware components were distributed through SYSVOL and NETLOGON and deployed using Group Policy; the payload encrypted files and left a ransom note.
- The article recommends patching internet-facing SharePoint, restricting and monitoring administrative tools and drivers, detecting unusual tunneling, and maintaining isolated, tested backups.
Article Details
- Attack Vectors
- Exploitation of vulnerable, internet-facing Microsoft SharePoint servers for initial access.
- DLL sideloading: MsMpSrv.exe loaded a malicious MsEdge.dll and established C2 communication.
- Deployment of a SharePoint web shell, cproxy.aspx, and later installation of Velociraptor.
- Credential access through DCSync and lateral movement using PsExec, PowerShell Remoting, and domain-administrator changes.
- Reverse SOCKS5 tunneling with Yuze and C2 channels using Cloudflare Tunnel and VS Code tunneling.
- BYOVD abuse of NSecKrnl.sys to terminate security processes, with tools and ransomware distributed through Group Policy.
- Exfiltration using a renamed Rclone executable to copy files to an attacker-controlled S3 bucket.
- Defensive Notes
- Patch on-premises SharePoint servers and reduce direct internet exposure of administrative interfaces.
- Use driver allowlisting and monitor driver installation, kernel-mode activity, and attempts to tamper with security processes.
- Restrict execution of dual-use administrative tools, segment administrative traffic, and limit privileged accounts.
- Monitor for unusual tunneling and egress to unknown IP addresses or domains, as well as suspicious PowerShell and reflective assembly loading.
- Maintain isolated, immutable backups and test recovery procedures.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | code[.]translatevv[.]com | C2 domain contacted by the Cobalt Strike beacon. |
| IPV4 | 198[.]13[.]158[.]193 | Identified by traffic analysis as the primary C2 endpoint for Yuze reverse-proxy connections. |
| URL | hxxps[:]//files[.]catbox[.]moe/wzsjlw[.]dll | URL used to download a payload identified as wssocks.exe. |
| URL | hxxps[:]//litter[.]catbox[.]moe/uaw2gm[.]txt | URL used to download a payload identified as wssocks.exe. |
| URL | hxxps[:]//litter[.]catbox[.]moe/zqqxb3[.]txt | URL used to download a payload identified as wssocks.exe. |
| URL | hxxps[:]//vdfccjpnedujhrzscjtq[.]supabase[.]co/storage/v1/object/public/image/v4[.]msi | Attacker-used payload-delivery URL for the Velociraptor installer. |
MITRE ATT&CK
T1003.006 · DCSyncdebug.exe impersonated a domain controller and retrieved credentials through MS-DRSR in a DCSync attack.T1021.002 · SMB/Windows Admin SharesThe attackers used domain shares, including SYSVOL and NETLOGON, to stage and distribute ransomware components.T1021.006 · Windows Remote ManagementPowerShell Remoting was enabled and used to execute commands on remote systems.T1027 · Obfuscated Files or InformationEncoded PowerShell commands and a random string embedded in a jQuery response were used to conceal activity.T1059.001 · PowerShellPowerShell commands downloaded and executed payloads, including through in-memory assembly loading.T1068 · Exploitation for Privilege EscalationThe attackers exploited a vulnerability in NSecKrnl.sys to perform kernel-level actions against security processes.T1105 · Ingress Tool TransferThe attackers downloaded the Velociraptor installer and other payloads onto compromised systems.T1190 · Exploit Public-Facing ApplicationWarlock exploited vulnerable, internet-facing SharePoint servers for initial access.T1218.011 · Rundll32The attackers used rundll32.exe to invoke RunCryptor from run.dll and to run Yuze.T1486 · Data Encrypted for ImpactThe ransomware encrypted files on affected systems.T1505.003 · Web ShellThe attackers wrote cproxy.aspx as a web shell in the SharePoint/IIS environment.T1562.001 · Disable or Modify ToolsA loader used the vulnerable driver to continuously terminate security-product processes.T1572 · Protocol TunnelingYuze established reverse SOCKS5 tunnels, while Cloudflare Tunnel and VS Code tunneling provided additional C2 channels.T1574.002 · DLL Side-LoadingMsMpSrv.exe sideloaded a malicious MsEdge.dll.T1620 · Reflective Code LoadingDownloaded .NET bytes were loaded into memory with [Reflection.Assembly]::Load() and invoked without being written to disk.
People
Threat Actors
Malware
Vendors
CrowdStrikeCrowdStrikeMicrosoftIn our previous article, we detailed how Warlock exploited unpatched Microsoft SharePoint servers to deploy LockBit-derived ransomware with the .x2anylock extension, using Cloudflare tunnels for command and controlSymantecSymantecTrendAIWe have identified new tactics, techniques, and procedures (TTPs) used by the Warlock ransomware group (tracked by TrendAI™ as Water Manaul).
Products
Microsoft EdgeThe legitimate binary was from the Microsoft Edge browser named MsMpSrv.exe (original: cookie_exporter.exe) that sideloads MsEdge.dll, which in this case contains malicious code.Microsoft SharePointIn our previous article, we detailed how Warlock exploited unpatched Microsoft SharePoint servers to deploy LockBit-derived ransomware with the .x2anylock extension, using Cloudflare tunnels for command and controlTrendAI Vision OneThrough TrendAI Vision One™ telemetry, our investigation was able to trace the earliest observed malicious activity to the SharePoint worker process (w3wp.exe) on the compromised server.VS CodeCombined with continued abuse of Velociraptor, VS Code tunnels, and Cloudflare Tunnel, this expanded toolkit gives Warlock multiple redundant C&C channels that blend with legitimate network traffic, demonstrating
Tools
CloudflaredAfter installing Cloudflared via MSI, the attacker first registered it as a persistent Windows service using service install with a pre-configured token, ensuring the tunnel would survive reboots.Cobalt StrikeThe telemetry revealed w3wp.exe spawning a Cobalt Strike beacon agent that utilized the DLL-sideloading technique.EndProcess.exeWithin seconds of the beacon deployment, a second tool named EndProcess.exe was dropped to C:\Temp\ by the same w3wp.exe process and subsequently executed.MimikatzPrevious research indicates that the threat actors employed Mimikatz and registry hive dumping.NSec-KillerThe NSec-Killer tool is publicly available at GitHub; however, the TA customized its implementation for this incident.PsExecreveals three key additions to the group's arsenal: TightVNC deployed silently as a Windows service via PsExec for persistent GUI-based remote access independent of their tunnel infrastructure; Yuze, a lightweightRCloneransomware with the .x2anylock extension, using Cloudflare tunnels for command and control (C&C) and Rclone for data exfiltration.RDP Patcher/WrapperRDP Patcher/WrapperTightVNCnew tactics to improve persistence, lateral movement, and defense evasion using an expanded toolset: TightVNC Yuze, and a persistent BYOVD technique leveraging the NSec driver.VelociraptorIn the previous campaigns, Warlock relied on Velociraptor as its primary C&C framework, paired with a single Cloudflare tunnel for remote access and Rclone disguised as TrendSecurity.exe for exfiltration.Yuzetactics to improve persistence, lateral movement, and defense evasion using an expanded toolset: TightVNC Yuze, and a persistent BYOVD technique leveraging the NSec driver.
Countries
GermanyBased on the group’s leak site from the second half of 2025, among the most targeted industries were technology, manufacturing, and government, while the US, Germany, and Russia were the countries most targeted.RussiaBased on the group’s leak site from the second half of 2025, among the most targeted industries were technology, manufacturing, and government, while the US, Germany, and Russia were the countries most targeted.UKTechnology, manufacturing, government, and education were among the most targeted industries, with the US, Germany, Russia, and the UK being the countries with the most victim counts.USBased on the group’s leak site from the second half of 2025, among the most targeted industries were technology, manufacturing, and government, while the US, Germany, and Russia were the countries most targeted.
Industries
EducationTechnology, manufacturing, government, and education were among the most targeted industries, with the US, Germany, Russia, and the UK being the countries with the most victim counts.GovernmentBased on the group’s leak site from the second half of 2025, among the most targeted industries were technology, manufacturing, and government, while the US, Germany, and Russia were the countries most targeted.ManufacturingBased on the group’s leak site from the second half of 2025, among the most targeted industries were technology, manufacturing, and government, while the US, Germany, and Russia were the countries most targeted.TechnologyBased on the group’s leak site from the second half of 2025, among the most targeted industries were technology, manufacturing, and government, while the US, Germany, and Russia were the countries most targeted.