CriticalRansomware
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
The Hacker News·Source published ·1 min read·Video available
Advisory videoOpen on YouTube ↗
What happened?
The suspected China-linked threat actor known as Warlock is still continuing to weaponize Microsoft SharePoint vulnerabilities, likely both old and new, in attacks targeting organizations in Portuguese- and Spanish-speaking countries. The activity, observed by the Symantec and Carbon Black Threat Hunter Team, has hit critical infrastructure, government, and education organizations. "In the
Key details
- China-linked threat actor Warlock continues exploiting SharePoint vulnerabilities against organizations in Portuguese- and Spanish-speaking countries.
- The group uses web shells to steal ASP.NET machine keys and forge signed payloads for remote code execution.
- Attackers disable security software using vulnerable driver K7RKScan.sys (CVE-2025-1055) via BYOVD technique.
- Warlock stages ransomware in SYSVOL share for domain-wide deployment via ordinary replication.
Affected
- On-premises Microsoft SharePoint Server deployments (unpatched or unmitigated).
- Organizations in Portuguese- and Spanish-speaking countries across Europe, Africa, and Latin America.
What to look for
- Web shells targeting multiple SharePoint versions dropped after initial access.
- Use of vulnerable driver K7RKScan.sys (CVE-2025-1055) for BYOVD security software disabling.
- Payloads downloaded from catbox.moe and wasabisys.com cloud storage services.
- VS Code tunnel connections established for remote access to compromised systems.
- Ransomware staged in domain SYSVOL share for mass deployment via replication.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.