Quick Takeaways
- The China-linked group Warlock is actively exploiting Microsoft SharePoint vulnerabilities to deploy web shells, enabling remote code execution and data theft in critical infrastructure, government, and educational sectors across Portuguese- and Spanish-speaking countries.
- Attackers use sophisticated techniques such as DLL sideloading, legitimate cloud storage for payloads, BYOVD exploits (via vulnerable drivers), and living-off-the-land tools like Visual Studio Code’s tunnel feature to evade detection and disable security defenses.
- Warlock has continuously refined its tactics since mid-2025, staging ransomware via compromised SharePoint servers, leveraging web shells for deeper network infiltration, and exploiting known vulnerabilities like ToolShell, making unpatched SharePoint deployments a critical attack vector.
Threat Overview, Attack Techniques, and Targets
The threat group called Warlock, also known as Gold Salem, Longlegs, and Storm-2603, is actively exploiting Microsoft SharePoint vulnerabilities. They use these flaws to gain unauthorized access to systems. Warlock has targeted organizations in Portuguese- and Spanish-speaking countries across Europe, Africa, and Latin America. Their recent attacks include critical infrastructure, government agencies, and educational institutions.
Warlock employs several attack methods. They deploy web shells on SharePoint servers to gather data and execute malicious code. They also use DLL sideloading to load harmful software into memory. Additionally, they abuse a vulnerable driver called K7RKScan.sys in a BYOVD attack to disable security tools. They often download payloads from common cloud storage sites to stay hidden. The threat actors use legitimate tools like Velociraptor for command-and-control purposes. They also stage payloads inside shared folders on the network, allowing for large-scale ransomware deployment.
Their activities include exploiting zero-day flaws, such as ToolShell, in SharePoint, to implant web shells, conduct reconnaissance, and execute remote code. These actions allow them to move deeper into networks and set up tunnels with tools like Microsoft Visual Studio Code. The ultimate goal is to deploy ransomware and disrupt affected organizations.
Impact, Security Implications, and Remediation Guidance
The ongoing exploitation of SharePoint vulnerabilities by Warlock poses serious risks. Critical infrastructure and government sectors face potential operational disruptions and data loss. Ransomware deployment can lead to costly downtime and affect public services. The use of techniques to disable security software makes detection and removal difficult.
If organizations have vulnerable SharePoint servers, they remain at high risk. Attackers can penetrate networks, steal sensitive data, and increase the scope of their attacks. The recent activity shows that unpatched systems are especially vulnerable to these exploits.
Organizations should seek remediation guidance from the relevant vendors or authorities. They need to apply security patches for SharePoint and related services. It is important to review network security measures and monitor for suspicious activities. Disabling unnecessary services and regularly updating security tools can help reduce risks. Keeping systems updated is essential to prevent exploitation by groups like Warlock.
Expand Your Tech Knowledge
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
