Warlock Exploits SharePoint Flaws to Disable Defenses and Deploy Ransomware
Summary
Warlock has exploited SharePoint flaws in attacks on organizations across Europe, Africa, and Latin America, using web shells, BYOVD, and SYSVOL staging to disable security tools and deploy ransomware.
Key points
- Symantec and Carbon Black reported attacks on at least four organizations in the preceding two months, including critical infrastructure operators, a regional government body, and a university.
- Targets were in Portuguese- and Spanish-speaking countries across Europe, Africa, and Latin America.
- Attackers used SharePoint web shells to collect ASP.NET machine keys and forge signed payloads for remote code execution in the SharePoint application pool.
- In one intrusion, a security-disabling tool reached at least 40 hosts; ransomware was then staged in SYSVOL and deployed to at least 33 hosts.
- The group used DLL sideloading, legitimate tools, and a vulnerable K7RKScan.sys driver in BYOVD attacks to disable security software.
- Attackers also used Microsoft Visual Studio Code tunnels for remote access and staged follow-on payloads through legitimate file-sharing services.
- Researchers said the activity continued as recently as July 22, 2026, and warned that unpatched or unmitigated SharePoint servers remain an access route.
Article Details
- Attack Vectors
- Exploitation of vulnerabilities in on-premises Microsoft SharePoint Server deployments to gain access and execute code in the SharePoint application pool.
- Web shells were used to obtain SharePoint farm ASP.NET machine keys, forge signed payloads, and achieve remote code execution.
- DLL sideloading was used to load malicious code into memory.
- A BYOVD attack abused the vulnerable K7RKScan.sys driver to disable security software.
- Payloads were downloaded from legitimate cloud file-sharing and storage services.
- Payloads were staged in the compromised domain's SYSVOL share for distribution to domain machines.
- Microsoft Visual Studio Code's tunnel feature was used to establish remote connections to compromised systems.
- Living-off-the-land tooling was used for reconnaissance and command execution.
- Defensive Notes
- Patch or otherwise mitigate exposed SharePoint Server vulnerabilities; the article identifies unpatched deployments as a viable initial-access route.
- Monitor for web shells, collection or misuse of SharePoint ASP.NET machine keys, and payload execution in the SharePoint application pool.
- Monitor for vulnerable-driver abuse intended to disable security software, payload staging in SYSVOL, and unexpected Visual Studio Code tunnels.
MITRE ATT&CK
T1105 · Ingress Tool TransferThe attackers downloaded follow-on payloads from cloud file-sharing and storage services.T1190 · Exploit Public-Facing ApplicationWarlock exploited vulnerabilities in on-premises SharePoint Server deployments to gain initial access.T1219 · Remote Access ToolsThe attackers used Visual Studio Code's built-in tunnel feature to establish remote connections to infected systems.T1505.003 · Web ShellAttackers dropped web shells on SharePoint servers to collect ASP.NET machine keys and enable further execution.T1562.001 · Disable or Modify ToolsA vulnerable K7RKScan.sys driver was abused in a BYOVD attack to disable security software.T1574.002 · DLL Side-LoadingThe attackers used DLL sideloading to load malicious code into memory.
CVE
Threat Actors
CamoFeiAn older activity cluster that Symantec says has overlaps with Warlock activity.ChamelGangAn older activity cluster that Symantec says has overlaps with Warlock activity.CL-CRI-1040An older activity cluster that Symantec says has overlaps with Warlock activity.DragonForceRansomware actors the article says previously exploited the K7RKScan.sys driver.Gold SalemIdentified in the article as an alternate name for Warlock.LonglegsIdentified in the article as an alternate name for Warlock.Storm-2603Identified in the article as an alternate name for Warlock.WarlockThreat actor reported exploiting SharePoint vulnerabilities and deploying ransomware; the article identifies Gold Salem, Longlegs, and Storm-2603 as alternate names.
Malware
Vendors
MicrosoftWarlock, also known as Gold Salem, Longlegs, and Storm-2603, is still exploiting Microsoft SharePoint vulnerabilities to attack organizations in Portuguese- and Spanish-speaking countries across Europe, Africa, andSmarterTools#Warlock #GoldSalem #Longlegs #Storm2603 #ToolShell #SmarterTools #SmarterMail #K7RKScan.sys #SharePoint
Products
Microsoft SharePoint ServerAttacks mounted by Warlock have leveraged multiple vulnerabilities in on-premises Microsoft SharePoint Server deployments.Microsoft Visual Studio CodeThis includes the abuse of Microsoft Visual Studio Code’s built-in tunnel feature to facilitate remote connections to infected systems.SmarterMail#Warlock #GoldSalem #Longlegs #Storm2603 #ToolShell #SmarterTools #SmarterMail #K7RKScan.sys #SharePoint
Tools
Industries
Critical infrastructureThe group has targeted critical infrastructure, government, and education sectors while using web shells, BYOVD, legitimate tools, and SYSVOL staging to disable defenses and deploy ransomware.EducationThe group has targeted critical infrastructure, government, and education sectors while using web shells, BYOVD, legitimate tools, and SYSVOL staging to disable defenses and deploy ransomware.GovernmentThe group has targeted critical infrastructure, government, and education sectors while using web shells, BYOVD, legitimate tools, and SYSVOL staging to disable defenses and deploy ransomware.Telecommunicationsat least four organizations, including two critical infrastructure operators (a water utility and a telecommunications provider), a regional government body, and a university,” the Broadcom-owned cybersecurity unit