Cybersecurity
Warlock uses SharePoint to attack multiple victims
BleepingComputer reported that Warlock used SharePoint vulnerabilities to reach a water utility, a telecom provider, a regional government body and a university, while researchers described disabled protection and ransomware deployment.
- BleepingComputer said Warlock targeted a water utility, a telecom provider, a regional government body and a university by exploiting SharePoint vulnerabilities.
- Symantec identified the same actor as Longlegs and said it developed the Warlock ransomware.
- In one intrusion that began on 22 July, researchers said a tool disabled protection on at least 40 hosts in about two hours and Warlock then ran on at least 33 hosts.
- Microsoft had previously said Linen Typhoon, Violet Typhoon and Storm-2603 were using ToolShell exploits in attacks.
Warlock targeted a water utility, a telecom provider, a regional government body and a university by exploiting SharePoint flaws for access, according to the report. The article said the group had been active since June 2025 and had become prominent in July after a chain of SharePoint zero-days, named ToolShell, was used.
Symantec identified the same actor as Longlegs and said it was behind Warlock ransomware. In an intrusion that started on 22 July, the researchers said a tool disabled protection on at least 40 hosts in about two hours, and ransomware was then launched on at least 33.
After gaining entry, the attacker placed a web shell that worked across SharePoint versions. Two days after initial access, the researchers said they saw reconnaissance activity and the removal of staging files.
The payload was placed in SYSVOL, and Visual Studio Code Insiders was installed as a service so the attacker could use its tunnelling function. On one system, researchers found NetExec, which they said was used for Active Directory enumeration, credential spraying and remote command execution.
Symantec and Carbon Black also said some attacks used a signed K7RKScan driver through a bring-your-own-vulnerable-driver method, and that the driver was vulnerable to CVE-2025-1055. The researchers warned that ToolShell and other SharePoint flaws were still usable entry points, and they published indicators of compromise.
Named in this story
Companies
- Microsoft
- the company that observed other groups using ToolShell exploits
- Symantec
- the security company that identified the actor as Longlegs
- Carbon Black
- the security company that co-authored the analysis of the driver-based killing tool
Organisations
- Warlock
- the ransomware group said to have targeted the victims through SharePoint flaws
- Longlegs
- the name Symantec used for the same actor behind Warlock
- Linen Typhoon
- a state-backed group Microsoft said was using ToolShell exploits
- Violet Typhoon
- a state-backed group Microsoft said was using ToolShell exploits
- Storm-2603
- the ransomware actor Microsoft tracked as using ToolShell exploits
Products and systems
- SharePoint
- the Microsoft product whose vulnerabilities were used for initial access
- ToolShell
- the SharePoint vulnerability chain exploited in the attacks
- Visual Studio Code Insiders
- the software installed as a service to support remote tunnelling
- NetExec
- the open-source framework found on one system and used for enumeration and spraying
- K7RKScan
- the signed driver used in a bring-your-own-vulnerable-driver attack
How the source tells it
The article used a standard security-report register, with alarm and urgency coming from the warning language and the host-count timeline.
- alarm a warning that SharePoint flaws remained usable entry points
- urgency short intrusion timing and host-count figures were used to heighten immediacy