The threat group known as Warlock is actively exploiting vulnerabilities in on-premises Microsoft SharePoint Server deployments to target government, education, and critical infrastructure organizations. According to research from Symantec and Carbon Black, the China-linked group has recently focused on victims in Portuguese- and Spanish-speaking regions across Europe, Africa, and Latin America. At least four organizations, including a water utility, a telecommunications provider, a regional government body, and a university, were compromised in recent months.
Exploitation Mechanics and Machine Key Abuse
Warlock, also tracked as Longlegs, Gold Salem, and Storm-2603, initially accesses targeted networks by dropping web shells onto vulnerable SharePoint servers. Once installed, these web shells collect ASP.NET machine keys from the SharePoint farm. The attackers then abuse these machine keys to forge validly signed payloads, enabling remote code execution directly within the SharePoint application pool.
Security Evasion and Payload Staging
To evade detection and spread lateral infection, Warlock relies on a combination of legitimate administrative capabilities and vulnerable software. The group has been observed using living-off-the-land techniques, such as leveraging built-in Visual Studio Code tunnel features to facilitate remote connections. For payload distribution, attackers stage malicious code within cloud file-sharing services like catbox.moe and wasabisys.com, as well as the compromised domain's SYSVOL share. In one instance, the group pushed a security-disabling tool to at least 40 hosts within two hours, leading to ransomware deployment on 33 machines via domain replication.
Disarming Endpoint Defenses
Warlock also employs the bring your own vulnerable driver technique to strip endpoint security software. The group abuses a vulnerable driver, K7RKScan.sys (CVE-2025-1055), to disarm active security tools on compromised hosts. Symantec and Carbon Black note that the persistent exploitation of SharePoint vulnerabilities, including flaws dating back to mid-2025, demonstrates that unpatched on-premises SharePoint deployments remain a primary target vector for enterprise intrusions.
AI-generated editorial illustration; not a documentary photograph.
Source: Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
SIGNAL TITANS
Leave a Reply