Warlock Ransomware Hits Water and Telecom via SharePoint: Hunt Now

Warlock's initial access relies on a chain of vulnerabilities in on-premises Microsoft SharePoint Server. The group's earliest documented exploitation used the ToolShell chain (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771) and has since incorporated newer 2026 CVEs including CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, CVE-2026-50522, and CVE-2026-55040.

The exploitation technique leverages ASP.NET machine key theft. SharePoint stores machine keys in its configuration, and an attacker who reads or guesses these keys can forge a signed __VIEWSTATE parameter that the ASP.NET runtime will process as a trusted, authenticated request. This __VIEWSTATE forgery allows the attacker to trigger deserialization of attacker-controlled objects within the SharePoint application pool, achieving remote code execution without any valid user credentials.

Once code execution is achieved inside the application pool, attackers use PowerShell to write ASPX webshells directly to the SharePoint LAYOUTS directory. The webshell names observed in current campaigns include layout2sp.aspx, spinstall.aspx, spinstall0.aspx, spinstall1.aspx, and spinstall2.aspx. The LAYOUTS directory is web-accessible by default, making any ASPX file placed there immediately callable over HTTP by the attacker.

From the webshell, Warlock operators execute discovery commands (net user /domain, whoami, nltest /domain_trusts, nxc.exe) to map the Active Directory environment before beginning lateral movement. The average time from initial SharePoint compromise to full domain-level situational awareness is under 30 minutes in documented incidents. Organizations running unpatched SharePoint Server must apply all current security updates immediately, using the Microsoft Security Update Guide at the patchUrl referenced below as the primary source for affected versions and available patches.

After establishing a foothold via SharePoint webshells, Warlock moves from the application server to the broader domain environment. The most operationally significant technique in the current campaign is the use of a bring-your-own-vulnerable-driver (BYOVD) attack to eliminate endpoint security before ransomware deployment.

Warlock drops K7RKScan.sys, a legitimate driver from Indian security vendor K7 Computing, onto compromised hosts. K7RKScan.sys is a signed, kernel-mode driver that carries CVE-2025-1055, a vulnerability that allows a local process to issue privileged kernel commands through the driver's IOCTL interface. Windows allows the driver to load because it carries a valid signature from K7 Computing. Once loaded, Warlock exploits the driver to terminate AV and EDR processes at the kernel level, bypassing any self-protection mechanisms the security software has implemented.

In the most recent confirmed incidents, Warlock disabled security software on 40 endpoints within approximately two hours of initial SharePoint compromise. On at least 33 of those hosts, the Warlock ransomware binary was deployed and executed within the same operational window.

The ransomware binary is staged through a distinctive delivery mechanism: Warlock copies run.exe and rune.exe to the domain SYSVOL share alongside a ransom note named "how to restore your files.txt." SYSVOL content is automatically replicated across all domain controllers and can be executed via Group Policy or domain scripts on every domain-joined machine. This delivery approach enables rapid, domain-wide ransomware deployment without requiring direct lateral movement to each target host.

The Velociraptor incident response framework is also used by Warlock as a legitimate-appearing C2 channel, alongside VS Code tunnels. Both abuse trusted, signed binaries to blend into expected enterprise traffic patterns.

Warlock's command-and-control infrastructure relies on legitimate tools rather than dedicated attacker domains, making detection harder for security controls that whitelist trusted software. The primary C2 channel in current campaigns is Microsoft Visual Studio Code's built-in tunnel feature.

VS Code Insiders includes a tunnel function that establishes a persistent, outbound connection from the target host to Microsoft's vscode.dev relay infrastructure. The binary is signed by Microsoft, and the tunnel traffic passes through Microsoft's own servers, which most organizations' security controls treat as trusted outbound destinations. Blocking VS Code tunnel traffic requires identifying and blocking the VS Code Insiders binary specifically on servers and infrastructure systems where developer tooling has no legitimate business justification.

The Velociraptor endpoint visibility and response framework appears in some Warlock intrusions as a secondary C2 option. Velociraptor is an open-source forensic platform that security teams use legitimately for incident response, which creates another blending-in opportunity for the attacker. An unexpected Velociraptor installation on a SharePoint server or domain controller is a high-confidence indicator of attacker activity.

DLL sideloading is also documented in Warlock intrusions, allowing additional payloads to execute in the context of trusted signed processes. The combination of signed-binary C2, BYOVD-based security evasion, and SYSVOL-based ransomware delivery represents a mature operational playbook designed specifically to defeat detection-oriented defenses.

Defenders should review proxy and DNS logs for VS Code tunnel connections (vscode.dev, tunnel.vscode.dev) originating from servers, treat any Velociraptor installation not deployed by their own IR team as suspicious, and implement application control policies that block VS Code Insiders on non-developer systems. The NetScaler backdoor persistence analysis published earlier this week highlights how attackers use similar living-off-the-land techniques to maintain access on perimeter appliances after patching.

The following indicators are confirmed or attributed to the Warlock campaign based on reporting from Symantec, Microsoft, and SecurityWeek. Block network-layer indicators at the firewall and DNS level immediately. Hunt for file-system and process indicators on SharePoint servers, adjacent Windows servers, and domain controllers.

The file hash below corresponds to a Warlock-associated binary identified in the most recent campaign reporting. Block it by hash in your EDR policy and submit it to your threat intelligence platform for enrichment.

These rules detect the two highest-confidence Warlock behaviors: ASPX webshell creation in SharePoint LAYOUTS directories and BYOVD driver load via K7RKScan.sys. Both carry experimental status; validate against your Sysmon and file auditing configurations before enabling automatic blocking. The rules target Sysmon file creation events (EventID 11) and driver load events (EventID 6).

These steps address the specific Warlock attack chain. Complete them in order; do not skip the detection phase before attempting containment. All discovery commands assume Windows Server environments with Active Directory and Sysmon deployed.

Warlock represents a convergence of two trends that make it particularly dangerous for defenders: the continued exploitation of on-premises collaboration platforms as an initial access vector, and the weaponization of legitimate enterprise tooling to blend into normal network activity.

The campaign's targeting of water utilities and telecommunications providers places it directly in the category of attacks on critical infrastructure with cascading public impact. A ransomware deployment on a water utility's control systems or a telecommunications provider's management infrastructure creates consequences that extend far beyond the victim organization. Regulators including CISA have consistently identified these sectors as priority protection targets for exactly this reason.

The BYOVD technique via K7RKScan.sys illustrates the arms race between detection-oriented endpoint security and attackers who have internalized that signed kernel drivers are a reliable bypass. Every EDR product that relies on self-protection against process termination is potentially vulnerable to a well-chosen vulnerable driver. This attack class is not new, but its appearance in an active ransomware campaign targeting critical infrastructure confirms it has crossed from research curiosity to standard operator playbook.

Organizations running on-premises SharePoint Server need to act on three fronts simultaneously: patch SharePoint to close the initial access vector, implement the detection rules in this post to find any prior Warlock activity, and review application control policies to restrict signed-but-abusable binaries like VS Code Insiders on infrastructure systems. For broader context on how attackers persist through patching cycles on network infrastructure, see the NetScaler backdoor persistence analysis from earlier this week.

The speed of Warlock's kill chain -- from SharePoint compromise to domain-wide ransomware in hours -- leaves little margin for detection and response after initial access. Patching and pre-deployment detection are the only realistic control points.