Warlock ransomware (Storm-2603) hits four organizations via SharePoint, disabling security tools on 40 hosts in two hours
China-linked group Storm-2603, the actor behind Warlock ransomware, reportedly attacked at least four organizations over two months, according to researchers cited on Oct. 1. Victims include a water utility, a telecommunications provider, a regional government body and a university in Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America. The likely entry point was unpatched on-premises Microsoft SharePoint, and researchers believe the group still carries the ToolShell exploits from July 2025 alongside newer SharePoint flaws. This opinion piece uses one critical-infrastructure intrusion to argue that defenders should not assume sensor-dependent controls will survive an attack, because the operators disabled security software before deploying the payload.
Detalhes técnicos
- On July 22, the attackers planted a web shell on a SharePoint server, then spent about a week mapping the domain, setting up covert remote access and adding an account, apparently named to resemble a SharePoint service account, to local administrator groups.
- Roughly a day of quiet followed, with only one piece of planted code running in the background.
- In the early hours of July 31, a tool built to disable security software ran on at least 40 hosts within about two hours, or about one machine every three minutes.
- Warlock was then staged in the domain's SYSVOL share and spread through ordinary replication to at least 33 hosts, appearing almost immediately after protection was removed.
- The article describes the attacker loading code into memory through sideloading and notes that a tool loading a vulnerable signed driver can terminate security software.
Remediação
- Patch on-premises SharePoint, including the ToolShell fixes shipped in July 2025, and keep EDR in place.
- Enable tamper protection and block known vulnerable drivers everywhere.
- Add preventive controls that decide on the host without depending on a console, cloud connection or analyst, such as memory-layout randomization on application load, so they act before the attacker gains rights to disable them.
- Establish who would be alerted if sensors go quiet, and record sensor-dependent protection as a risk in the risk register.
Linha do tempo
-
Warlock ransomware (Storm-2603) hits four organizations via SharePoint, disabling security tools on 40 hosts in two hours
ler a análise desta fonte ocultar
China-linked group Storm-2603, the actor behind Warlock ransomware, reportedly attacked at least four organizations over two months, according to researchers cited on Oct. 1. Victims include a water utility, a telecommunications provider, a regional government body and a university in Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America. The likely entry point was unpatched on-premises Microsoft SharePoint, and researchers believe the group still carries the ToolShell exploits from July 2025 alongside newer SharePoint flaws. This opinion piece uses one critical-infrastructure intrusion to argue that defenders should not assume sensor-dependent controls will survive an attack, because the operators disabled security software before deploying the payload.
Technical Details
- On July 22, the attackers planted a web shell on a SharePoint server, then spent about a week mapping the domain, setting up covert remote access and adding an account, apparently named to resemble a SharePoint service account, to local administrator groups.
- Roughly a day of quiet followed, with only one piece of planted code running in the background.
- In the early hours of July 31, a tool built to disable security software ran on at least 40 hosts within about two hours, or about one machine every three minutes.
- Warlock was then staged in the domain's SYSVOL share and spread through ordinary replication to at least 33 hosts, appearing almost immediately after protection was removed.
- The article describes the attacker loading code into memory through sideloading and notes that a tool loading a vulnerable signed driver can terminate security software.
Remediation
- Patch on-premises SharePoint, including the ToolShell fixes shipped in July 2025, and keep EDR in place.
- Enable tamper protection and block known vulnerable drivers everywhere.
- Add preventive controls that decide on the host without depending on a console, cloud connection or analyst, such as memory-layout randomization on application load, so they act before the attacker gains rights to disable them.
- Establish who would be alerted if sensors go quiet, and record sensor-dependent protection as a risk in the risk register.