Warlock Ransomware Group Exploits SharePoint Flaws and Disables Security Tools
Summary
Researchers detail Warlock attacks that exploited SharePoint flaws, used a vulnerable driver to disable protection on at least 40 hosts, and deployed ransomware across organizations in Europe, Africa, and Latin America.
Key points
- Warlock used vulnerabilities in on-premises SharePoint deployments, including ToolShell flaws, to gain initial access.
- Symantec links Warlock to the actor Longlegs and attributes development of the ransomware to the group.
- Attackers used a signed K7RKScan driver vulnerable to CVE-2025-1055 to disable AV/EDR protection on at least 40 hosts.
- In one intrusion, Warlock ransomware was launched on at least 33 hosts after security protections were disabled.
- The attackers staged the ransomware payload in the domain SYSVOL share and used VS Code tunneling for remote access.
- NetExec was found on a compromised system and was used for Active Directory enumeration, credential spraying, and remote command execution.
Article Details
- Attack Vectors
- Exploited vulnerabilities in on-premises Microsoft SharePoint deployments for initial access.
- Used a signed K7RKScan driver vulnerable to CVE-2025-1055 via BYOVD to deploy an AV/EDR-killing tool.
- Used VS Code tunneling to connect remotely to compromised machines.
- Used NetExec for Active Directory enumeration, credential spraying, and remote command execution.
- Staged the Warlock ransomware payload in the domain SYSVOL share before deploying it across hosts.
- Defensive Notes
- The researchers warn that ToolShell and other SharePoint vulnerabilities remain viable initial access vectors.
- The AV/EDR-killing tool disabled protection on at least 40 hosts in about two hours; Warlock ransomware was launched on at least 33 hosts.
MITRE ATT&CK
T1021 · Remote ServicesNetExec was used for remote command execution during the intrusion.T1070.004 · File DeletionThe threat actor deleted what researchers described as apparent staging artifacts.T1110.003 · Password SprayingNetExec was used for credential spraying.T1190 · Exploit Public-Facing ApplicationWarlock exploited vulnerabilities in on-premises SharePoint deployments for initial access.T1219 · Remote Access ToolsThe attacker used VS Code's built-in tunneling capability to connect remotely to compromised machines.T1486 · Data Encrypted for ImpactWarlock ransomware was launched on compromised hosts after protection was disabled.T1505.003 · Web ShellAfter gaining access, the attacker dropped a web shell designed to function across multiple SharePoint versions.T1562.001 · Disable or Modify ToolsAn AV/EDR-killing tool disabled protection on at least 40 hosts.
CVE
CVE-2025-1055the bring your own vulnerable driver (BYOVD) technique using a signed K7RKScan driver vulnerable to CVE-2025-1055.CVE-2025-49704after exploiting a chain of zero-day vulnerabilities in Microsoft SharePoint known as ToolShell (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771).CVE-2025-49706a chain of zero-day vulnerabilities in Microsoft SharePoint known as ToolShell (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771).CVE-2025-53770zero-day vulnerabilities in Microsoft SharePoint known as ToolShell (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771).CVE-2025-53771in Microsoft SharePoint known as ToolShell (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771).
Threat Actors
Linen TyphoonMicrosoft observed the group using ToolShell exploits in attacks.LonglegsName Symantec uses for the actor it links to Warlock and attributes development of the Warlock ransomware to.Storm-2603Threat actor Microsoft tracks as a ransomware actor that used ToolShell exploits in attacks.Violet TyphoonMicrosoft observed the group using ToolShell exploits in attacks.WarlockRansomware group that targeted organizations by exploiting SharePoint vulnerabilities; Symantec identifies the same actor as Longlegs.
Malware
Products
Microsoft SharePoint2025 and gained notoriety a month later after exploiting a chain of zero-day vulnerabilities in Microsoft SharePoint known as ToolShell (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771).Visual Studio Code InsidersDuring the attack, the main executable file for Visual Studio Code Insiders was installed as a service to enable connecting remotely to compromised machines using VS Code’s built-in tunneling capability.