Warlock ransomware: how SharePoint becomes the front door
You may not have a SharePoint server in the back room. Operators of Warlock ransomware are still hunting those who do — especially if they are Internet-facing and poorly patched. According to a Symantec / Security.com report around October 2, 2026, the group tracked as Longlegs and Storm-2603 hit at least four organizations in Portuguese- and Spanish-speaking countries over the prior two months: a water utility, a telecom provider, a regional government body and a university.
Warlock emerged in June 2025 and made headlines by exploiting the SharePoint exploit chain known as ToolShell. More than a year later, on-premises SharePoint remains a viable front door. Here is the typical attack timeline, then what it means for a Greater Montreal SMB.
Timeline of a Warlock intrusion
Stage 1
Initial access
Exploitation of on-premises SharePoint flaws (ToolShell and related CVEs). Webshell dropped into the LAYOUTS folder for multiple SharePoint versions at once.
Stage 2
Foothold
Theft of the SharePoint farm’s ASP.NET machine keys, then a forged signed payload for code execution inside the app pool. Active Directory reconnaissance (whoami, nltest).
Stage 3
Disable defenses
BYOVD with the signed but vulnerable K7RKScan driver (CVE-2025-1055) to kill AV/EDR at kernel level. In one July 2026 case: the tool reached ~40 hosts in about two hours.
Stage 4
Lateral movement
DLL sideloading, downloads from legitimate cloud hosts, a Visual Studio Code Insiders tunnel for quiet remote access, NetExec for domain enumeration and execution.
Stage 5
Ransomware
Warlock payload staged in the domain SYSVOL share (replicated to every domain controller). In the same July case: encryption on at least 33 hosts almost as soon as protection was disabled.
Sources: Symantec Threat Hunter / Security.com; BleepingComputer and SecurityWeek roundups (October 2026). July 2026 case details (40 hosts / 33 hosts) are from Symantec.
What Symantec observed (verified facts)
- Actor: China-nexus, tracked as Longlegs (Symantec) and Storm-2603 (Microsoft); also tied to older clusters (CL-CRI-1040, CamoFei, ChamelGang).
- Preferred vector: vulnerable on-premises SharePoint Server. ToolShell (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771) opened the door in 2025; Symantec notes that newer SharePoint flaws (including some CISA flagged in July 2026) remain plausible.
- Recent targets: critical infrastructure (water, telecom), regional government, education; Portuguese/Spanish-language concentration in the two-month window, with a wider historical footprint (United States, Brazil, India and more).
- Unusual persistence: installing
code-insiders.exeas a tunnel service — Microsoft-signed, traffic that blends with a developer or admin workstation. - Mass deployment: staging under
SYSVOL...scripts, so ordinary DFS replication carries the payload domain-wide.
Even without on-prem SharePoint: 5 lessons for SMBs
- Patch every Internet-facing collaboration tool — SharePoint, but also VPN, firewall, webmail, customer portals. Ransomware groups recycle flaws as long as unpatched servers remain.
- Turn on EDR/antivirus tamper protection and watch for unusual driver installs. BYOVD (bring your own vulnerable driver) exists specifically to shut down defenses right before encryption.
- Isolate backups: offline or immutable copies, tested. If Warlock encrypts via SYSVOL, a backup glued to the same domain will not save you.
- Least privilege and service accounts: a SharePoint or “setup” account added to local Administrators (as Symantec saw) should page someone.
- Watch unusual behaviour: VS Code tunnels on a server, NetExec, bursts of
net localgroup administrators, new files in SYSVOL. Well-tuned cyber monitoring often catches those signals before the ransom note.
How NeoTech can help
At NeoTech Cloud Solutions, we help SMBs in Laval, Montreal and the North Shore shrink Internet exposure, patch collaboration services and harden Active Directory. Our cybersecurity services cover inventory, patching and hardening. Our cyber monitoring plans add 24/7 automated monitoring with on-call technician response. If your team lives in Microsoft 365, we also make sure the cloud is not the forgotten gap beside an old on-prem server.
Book your free cyber check
Still running SharePoint, an old portal or an exposed gateway you forgot about? In a short meeting we map what is reachable from the Internet and you leave with clear priorities. No jargon, no commitment.
Call 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- Symantec / Security.com: Warlock Ransomware Attackers Hit Water and Telecom Operators
- BleepingComputer: Warlock ransomware breach SharePoint in water, telecom operator attacks
- SecurityWeek: Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks (October 2, 2026)
- Trend Micro: Warlock — From SharePoint Vulnerability Exploit to Enterprise Ransomware (ToolShell 2025 context)
Photo: Pixabay via Pexels.
One thought on “Warlock ransomware: how SharePoint becomes the front door”