Warlock Ransomware Still Exploits Year-Old SharePoint Flaws to Hit Critical Infrastructure

Summary

Warlock ransomware operators continue to exploit unpatched, internet-facing Microsoft SharePoint servers more than a year after the ToolShell vulnerability chain was first disclosed. Symantec tracks the China-nexus group behind Warlock as Longlegs, also known as Storm-2603, and has associated it with older activity clusters including CL-CRI-1040, CamoFei, and ChamelGang.

Recent victims include a water utility, telecommunications provider, regional government organization, and university across Europe, Africa, and Latin America. Warlock attacks have also been observed against organizations in the United States, Brazil, India, Russia, Taiwan, and Japan.

The attackers exploit SharePoint vulnerabilities to deploy a web shell, steal ASP.NET machine keys, and generate signed malicious payloads that execute inside the SharePoint application pool. The intrusion then progresses through reconnaissance, DLL sideloading, payload delivery, persistent remote access, privilege expansion, security-tool disruption, lateral movement, and domain-wide ransomware deployment.

Background

Warlock ransomware emerged in June 2025 and gained attention when Storm-2603 began exploiting the Microsoft SharePoint vulnerability chain known as ToolShell. ToolShell combines authentication-control weaknesses with remote code execution vulnerabilities affecting on-premises SharePoint Server deployments.

Longlegs continues to favor SharePoint vulnerabilities for initial access. The group installs web shells in SharePoint LAYOUTS directories and designs them to operate across different SharePoint versions. These web shells extract ASP.NET machine keys that can be used to sign malicious ViewState payloads.

Once code execution is established, the group uses legitimate utilities and trusted services to reduce detection. Observed techniques include PowerShell, Windows command-line tools, DLL sideloading, MSI installation, NetExec, Visual Studio Code tunnels, public file-hosting services, and vulnerable signed drivers.

In previous attacks, Longlegs used the vulnerable signed K7RKScan driver to terminate protected security processes before deploying ransomware. In the detailed 2026 intrusion, the exact driver used by the AV/EDR-killing tool could not be conclusively identified.

Vulnerability Details

The ToolShell attack chain is associated with four SharePoint vulnerabilities. The original chain combined CVE-2025-49706 and CVE-2025-49704. CVE-2025-53771 and CVE-2025-53770 addressed related weaknesses that could bypass protections introduced for the earlier vulnerabilities.

These vulnerabilities affect on-premises SharePoint Server deployments. SharePoint Online in Microsoft 365 is not affected.

Attack Methodology

Initial Access Through SharePoint

Longlegs identifies exposed, unpatched SharePoint servers and exploits the ToolShell vulnerability chain. The attacker then installs a web shell in a SharePoint LAYOUTS directory, allowing commands to execute through the w3wp.exe IIS worker process.

Machine-Key Theft and Signed Payload Execution

The web shell extracts the SharePoint farm's ASP.NET validation and decryption keys. Using this key material, the attacker creates a malicious __VIEWSTATE payload with a signature that SharePoint accepts as valid.

When the forged payload is processed, a .NET deserialization gadget executes attacker-controlled code inside the SharePoint application pool.

Discovery and Domain Enumeration

The attackers use standard Windows utilities to identify:

• The current user and privilege context
• Domain users and administrative accounts
• Active Directory domain trusts
• Reachable computers and services
• Potential paths for lateral movement

Observed commands included whoami, net user /domain, and nltest /domain_trusts.

DLL Sideloading and Payload Delivery

Longlegs uses legitimate executables to sideload malicious DLLs. Observed executable and DLL pairs included doexe.exe with doexeloc.dll, as well as ssvagent.exe and logger.exe with malicious DLL components.

Additional MSI packages were downloaded from legitimate public hosting services, including catbox.moe and wasabisys.com. Using legitimate hosting infrastructure helps malicious traffic blend with expected web activity.

Privilege Expansion and Persistent Remote Access

The attackers added a domain account named SPSEPRDSetup to local Administrators groups on multiple systems. The SharePoint-style name may have been selected to make the account appear legitimate.

Visual Studio Code Insiders was also installed as a tunneling service. Because the executable is signed by Microsoft and communicates through Microsoft infrastructure, the resulting traffic may resemble legitimate developer or administrator activity.

Defense Evasion and Ransomware Deployment

Before deploying Warlock, the attackers distributed a tool intended to disable antivirus and EDR protection. The tool was observed on at least 40 systems within approximately two hours.

Warlock payloads named run.exe and rune.exe were then staged in the domain's SYSVOL share. Because SYSVOL is replicated across domain controllers, normal Distributed File System Replication activity delivered the ransomware files throughout the domain.

Warlock was observed on at least 33 systems shortly after security protection was disabled.

Indicators of Compromise (IOCs)

File, Account, and Network Indicators

SHA-256 Indicators

Domains belonging to public hosting or development services may also support legitimate activity. Treat matches as investigation leads and correlate them with file, process, identity, SharePoint, and network telemetry.

MITRE ATT&CK Mapping

Visual Attack Flow

Mitigation

Organizations should treat exposed and unpatched on-premises SharePoint servers as potentially compromised. Security updates prevent known exploitation paths, but they do not remove existing web shells, invalidate stolen ASP.NET machine keys, terminate persistent access, or reverse changes made after compromise.

• Patch the entire SharePoint farm: Apply the latest cumulative security updates to every SharePoint server. Confirm that all required language-dependent and language-independent packages are installed. The July 2025 minimum baselines are KB5002768 for Subscription Edition, KB5002754 and KB5002753 for SharePoint Server 2019, and KB5002760 and KB5002759 for SharePoint Server 2016. Deploy newer cumulative updates when available.
• Rotate ASP.NET machine keys: After patching, rotate the SharePoint farm’s validation and decryption keys and restart IIS on every server. This prevents attackers from continuing to use previously stolen keys to sign malicious ViewState payloads.
• Enable SharePoint AMSI protection: Configure AMSI integration in Full Mode and verify that it is active across the farm. This improves inspection of scripts, commands, and malicious payloads processed by SharePoint.
• Reduce external exposure: Remove direct internet access to SharePoint wherever possible. If external access is required, use an authenticated application gateway or reverse proxy and restrict access to approved users, devices, and networks.
• Hunt for compromise: Search SharePoint LAYOUTS directories for unexpected ASPX files such as layout2sp.aspx. Investigate w3wp.exe launching PowerShell, command shells, MSI installers, or unfamiliar executables.
• Review persistence and lateral movement: Hunt for the SPSEPRDSetup account, unauthorized administrator-group changes, Visual Studio Code tunnels, suspicious DLL-sideloading pairs, and matches for the indicators listed in the IOC section.
• Inspect SYSVOL: Search for run.exe, rune.exe, unfamiliar executables, or staging directories. Review domain-controller replication activity for evidence of ransomware distribution.
• Contain confirmed compromises: Isolate affected systems, reset exposed credentials, remove attacker-created access, and investigate lateral movement. Rebuild SharePoint servers when web-shell deployment, machine-key theft, or administrative compromise is confirmed.