Warlock Ransomware: China-Linked Group Exploits Year-Old SharePoint Flaws to Hit Critical Infrastructure

Updated October 13, 2026 — A China-linked ransomware crew called Warlock is still breaking into organisations through on-premises SharePoint servers that were patched more than a year ago — and once inside, it silences endpoint protection across dozens of machines in under two hours. Water utilities, telecoms, regional governments, and universities have all been hit. If your SharePoint deployment is not fully current, or your zero-trust controls cannot catch a rogue signed driver, you are squarely in the crosshairs.

Why This Story Should Alarm Every SOC Team Right Now

When Microsoft released emergency patches for the SharePoint ToolShell vulnerability chain in July 2025, the cybersecurity community’s response was rapid — on paper. CISA issued an advisory, vendors pushed alerts, and the incident response community documented the attack path in detail. Yet in October 2026, more than fifteen months later, the China-linked Warlock group is walking through the same open door again and again.

The lesson is as uncomfortable as it is familiar: patch velocity is the most exploited gap in enterprise defences. Attackers do not need new zero-days when defenders leave known critical flaws open for over a year. Warlock’s latest campaign, detailed in Symantec’s October 2026 threat intelligence report and covered by The Record and Security Affairs, is a textbook demonstration of how patient, disciplined threat actors can keep exploiting the same surface long after a patch exists.

This is not a story about sophisticated nation-state hacking. It is a story about operational discipline — or the lack of it.

The Warlock Threat Actor: Longlegs, Storm-2603, and the China Connection

The group responsible for deploying Warlock ransomware carries multiple tracking identifiers. Symantec’s Threat Hunter team calls the actor Longlegs and assesses it as China-linked based on tooling overlaps, infrastructure patterns, and victimology consistent with Chinese state-aligned objectives. Microsoft tracks the same cluster under the designation Storm-2603. This is a vendor attribution, not a formal government charge — but the consistency across independent vendor analyses is notable.

The group has been active since at least 2025 and has consistently targeted critical infrastructure operators, government bodies, and communications providers. The October 2026 wave expanded to universities and regional government entities, suggesting the group is broadening its target set, possibly to harvest intellectual property alongside the ransomware revenue.

Technical Deep-Dive: The ToolShell Entry Chain

Warlock’s initial access relies on the ToolShell vulnerability chain in on-premises Microsoft SharePoint Server. The four CVEs involved are:

CVE	Type	Patched	CVSS
CVE-2025-49704	Authentication bypass	July 2025	9.8 Critical
CVE-2025-49706	Remote code execution	July 2025	9.8 Critical
CVE-2025-53770	Privilege escalation (chain component)	July 2025	8.8 High
CVE-2025-53771	Webshell persistence	July 2025	8.8 High

The attack flow works like this:

1. Initial access: Attackers send a crafted HTTP request to an unpatched SharePoint server, exploiting the authentication bypass (CVE-2025-49704) and RCE (CVE-2025-49706) to execute code without credentials.
2. Webshell implant: A persistent webshell is planted in SharePoint’s LAYOUTS directory, providing durable command execution through the web server process.
3. Machine key theft: Attackers steal the ASP.NET machine keys from the SharePoint server. This is significant: machine keys allow attackers to forge authenticated ViewState requests across all ASP.NET applications on the same server farm, enabling persistent re-entry even if the webshell is removed.
4. Lateral movement via SYSVOL: The group abuses Active Directory’s SYSVOL share to distribute attack tooling and move laterally across domain-joined systems — a technique that blends into normal domain traffic and evades many detection rules.

The BYOVD Killchain: Disabling 40 Machines’ Defences in Two Hours

What makes the Warlock campaign especially dangerous is not the initial entry — it’s what happens next. Once inside the network, the group deploys a Bring-Your-Own-Vulnerable-Driver (BYOVD) attack using the legitimate but vulnerable K7RKScan antivirus driver, tracked as CVE-2025-1055.

Here is why this matters: Windows kernel-mode drivers run at the highest privilege level. A signed driver with a known privilege-escalation or memory-corruption vulnerability can be loaded by an attacker and then exploited to terminate other processes — including your EDR agent — from kernel space, where the EDR cannot defend itself.

In one documented critical-infrastructure intrusion, Warlock used this technique to disable endpoint protection on at least 40 machines in approximately two hours. Once defences were blind, the group deployed Warlock ransomware to at least 33 of those hosts. Response teams arrived at what looked like an EDR outage, only to find encryption already underway.

This attack pattern — use a trusted driver to kill security tools, then detonate ransomware — has become a standard play for sophisticated ransomware groups. Microsoft maintains a Vulnerable Driver Blocklist, and Windows Defender Credential Guard’s driver blocklist feature can prevent loading of known-bad drivers. If you are not enforcing these controls, your EDR has an exploitable blind spot.

India’s On-Premises SharePoint Exposure

India’s enterprise and government landscape has a specific risk factor here. Thousands of Indian organisations — from public-sector undertakings to mid-market enterprises — run on-premises Microsoft SharePoint Server for intranets, document management, and workflow. Many of these deployments are several months behind on cumulative updates, owing to change-management cycles, resource constraints, or the perception that on-premises environments are “not internet-facing.”

The Warlock campaign should dispel that notion. SharePoint management interfaces and web services are frequently exposed to internal networks that are themselves reachable via VPN, partner links, or compromised endpoints. The attacker does not need direct internet access to the SharePoint server if they can first compromise a laptop or a mail server that has internal connectivity.

Critical infrastructure organisations in India — power distribution companies, water utilities, telecom operators — should treat this campaign as a direct warning.

What You Should Do: Sanjay Seth’s Defensive Playbook

Here is an actionable checklist for IT and security teams in India and the wider Asia-Pacific region:

Immediate Actions (0–72 Hours)

• Patch SharePoint now. Apply Microsoft’s July 2025 cumulative updates for SharePoint Server 2019, Subscription Edition, and Server 2016 (where supported). Verify by checking the installed build number against Microsoft’s SharePoint update history page. Do not rely on WSUS report status alone — verify the DLL version on disk.
• Enable the Microsoft Vulnerable Driver Blocklist. On Windows 11 and Server 2022+, go to Windows Security → Device Security → Core Isolation → Microsoft Vulnerable Driver Blocklist. On older systems, deploy the blocklist via Windows Defender Application Control (WDAC) policy. Block K7RKScan explicitly if your organisation does not use K7 antivirus.
• Audit SharePoint LAYOUTS directories. Check for unexpected files — especially .aspx, .ashx, or .asmx files not present in your baseline. Use PowerShell to list recently modified files: Get-ChildItem -Path "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\16\TEMPLATE\LAYOUTS" -Recurse | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-30)}.
• Rotate ASP.NET machine keys. If SharePoint was unpatched at any point in the last 15 months, assume machine keys may be compromised. Rotate them via SharePoint Central Administration or PowerShell and issue new keys to all servers in the farm.

Short-Term Controls (1–4 Weeks)

• Monitor SYSVOL for anomalous writes. Create a SIEM rule alerting on new script files written to SYSVOL by non-administrator accounts. Warlock uses SYSVOL for lateral movement payload distribution.
• Deploy network segmentation between SharePoint and domain controllers. Zero-trust micro-segmentation should prevent a webshell on a SharePoint server from directly touching domain controllers, SYSVOL, or backup infrastructure.
• Review EDR telemetry for kernel driver loading events. Search for load events for K7RKScan.sys or any drivers not in your approved baseline. Many EDR platforms can generate an alert on first-time driver loads.
• Enable SharePoint audit logging and forward logs to your SIEM with alerting on LAYOUTS directory writes and machine-key access events.

Strategic Hardening

• Evaluate migration from on-premises SharePoint to Microsoft 365 SharePoint Online, which eliminates the entire ToolShell attack surface at the network layer.
• Implement a Zero Trust Network Access (ZTNA) policy that requires device health verification before allowing access to any SharePoint resource — even internal ones.
• Run tabletop exercises simulating the Warlock intrusion chain: initial webshell detection, machine key rotation, BYOVD response, and ransom negotiation.

Frequently Asked Questions

Is Warlock ransomware related to any other known group?

Symantec tracks the Warlock operator as Longlegs and assesses a China-nexus affiliation. Microsoft’s designation is Storm-2603. The group shows tooling and infrastructure overlaps with previously observed China-aligned APT clusters, but formal government attribution has not been published. The ransomware itself does not appear to be a renamed variant of an existing publicly documented strain — it is assessed as custom-built or heavily modified.

Are SharePoint Online or Microsoft 365 customers at risk?

No. The ToolShell vulnerability chain (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771) is specific to on-premises SharePoint Server. Microsoft-managed SharePoint Online infrastructure is patched and managed by Microsoft and is not exposed to this attack path. Organisations running SharePoint Online are not affected by this campaign.

What makes BYOVD attacks so difficult to detect?

The attacker loads a legitimately signed driver — one that Windows trusts because it has a valid Microsoft-issued signature. Conventional EDR products run in user space or as early-launch antimalware kernel drivers, but a vulnerable third-party kernel driver can be exploited to terminate those same processes from a higher privilege context. Detection requires monitoring for specific driver hashes (the vulnerable version of K7RKScan.sys), unexpected driver load events, or sudden drops in EDR agent heartbeats — all of which should be configured as high-priority alerts in your SIEM.

Should I be worried if we patched SharePoint in late 2025 rather than July 2025?

If your SharePoint was unpatched and internet- or intranet-accessible between July 2025 and whenever you applied the patch, you should assume a possible compromise window. Conduct a forensic review of LAYOUTS directory contents, check ASP.NET machine key material, review IIS access logs for unusual LAYOUTS requests, and rotate all machine keys. The mere act of patching does not evict a webshell that was already planted.

The Broader Zero-Trust Lesson

The Warlock campaign encapsulates one of the most important principles in modern security architecture: a single unpatched server can unravel an entire network’s defences. No matter how strong your perimeter firewall or how capable your EDR, a persistent webshell on an unpatched SharePoint server gives an attacker a patient, low-noise foothold from which to enumerate your environment, steal credentials, abuse signed drivers to kill your defences, and deploy ransomware at scale.

Zero-trust architecture addresses this by assuming breach at every layer — enforcing identity verification, device health checks, and micro-segmentation so that even if the SharePoint server is compromised, the attacker cannot freely reach domain controllers, SYSVOL, or critical infrastructure control systems. The path from “SharePoint webshell” to “33 hosts encrypted” requires multiple lateral movement steps that a well-implemented zero-trust architecture would detect and block.

Fortinet’s Zero Trust Access (ZTA) framework, for example, can enforce per-session verification of device trust before any application-layer SharePoint request is permitted — even from inside the corporate network. If you are still relying on implicit trust for internal applications, this campaign is your wake-up call.

Sources: Symantec Threat Hunter Team (Broadcom) | The Record | Security Affairs | BleepingComputer | Microsoft SharePoint Updates

---