Warlock Ransomware Attackers Hit Water and Telecom Operators

Immediate Actions

Key Takeaways

• Four organizations breached in two months including water utility and telecom provider
• SharePoint CVEs CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771 remain exploited
• AV/EDR killer pushed to 40+ hosts within two hours using BYOVD technique
• Warlock deployed to 33+ hosts via SYSVOL replication rather than individual pushes
• VS Code tunnel feature abused as signed, covert remote access service

Attack Chain

1. Initial Access: Exploit SharePoint ToolShell vulnerabilities to deploy webshell and harvest ASP.NET machine keys
2. Execution: Forge signed ViewState payloads for deserialization RCE in SharePoint application pool
3. Discovery & Lateral Movement: Use LOTL tools and NetExec for AD enumeration and credential spraying across domain
4. Defense Evasion: Deploy DLL sideloading pairs; push BYOVD AV/EDR killer to 40+ hosts via SMB
5. Persistence: Install VS Code tunnel as service for covert remote access through Microsoft infrastructure
6. Impact: Stage Warlock ransomware in SYSVOL; deploy to 33+ hosts via DFS replication

Affected Systems

• Microsoft SharePoint Server (on-premises)
• Windows domain-joined hosts
• Active Directory environments with SYSVOL
• Water utility operational infrastructure
• Telecommunications provider infrastructure

Vulnerabilities (CVEs)

Detection Availability

No detection rules or queries are published in the source article.

Detection Engineering Assessment

Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.

Hunting Hypotheses

Required Log Sources

• SharePoint IIS logs
• Windows Security event logs
• Sysmon process creation events
• DNS resolution logs
• SMB share access logs
• DFS Replication logs

Key Behavioral Indicators

• w3wp.exe spawning cmd.exe or powershell.exe on SharePoint servers
• dfsrs.exe spawning run.exe or rune.exe from SYSVOL scripts path
• net use to internal IP followed by copy and execution of a.exe
• msiexec.exe with URLs pointing to catbox.moe or wasabisys.com
• code-insiders.exe running as service on non-developer hosts
• DLL files with .tmp extension loaded alongside executables in System32 subdirectories

Control Gaps

• SYSVOL share not monitored for executable content staging
• Cloud storage egress not blocked for msiexec.exe downloads
• BYOVD attacks not prevented by driver blocklist rules
• VS Code tunnel traffic indistinguishable from legitimate dev traffic
• DLL sideloading via .tmp extension DLLs not detected

False Positive Assessment

Recommendations

Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.

Infrastructure Hardening

• Deploy driver blocklist rules to prevent K7RKScan and other vulnerable drivers from loading
• Restrict outbound traffic from SharePoint servers to approved destinations only
• Monitor DFS Replication events for non-policy executable content in SYSVOL
• Block msiexec.exe from making outbound HTTPS connections to cloud storage services

User Protection

• Deploy EDR with behavioral detection for DLL sideloading via .tmp extension files
• Alert on code-insiders.exe installed as a Windows service outside developer OUs
• Monitor for net localgroup administrators additions of SPS-prefixed accounts
• Enable PowerShell script block logging to capture encoded payloads

Security Awareness

• Train SharePoint administrators to recognize webshell artifacts in LAYOUTS directories
• Brief IT staff on VS Code tunnel feature abuse for covert remote access

MITRE ATT&CK Mapping

Plain-Language Summary

A China-linked hacking group called Longlegs is breaking into organizations through security flaws in Microsoft SharePoint software. They target critical services like water utilities and telecom providers, mostly in Portuguese and Spanish-speaking countries. Once inside, they disable antivirus tools and spread Warlock ransomware across entire networks using built-in Windows file replication. Patch SharePoint servers and monitor for unusual activity.

Additional IOCs

• File Hashes:
  • 155fb1cbdaea12c83ba92d18c88cf38bbc42bb684f913ca0bc26fcf115426a55 (SHA256) - Warlock ransomware binary
  • 1edb2c0b537cd95bbd5fc16321b4c38a6adf325ccc7b588ad6acc980b0463b60 (SHA256) - Malicious DLL for sideloading
  • 206f27ae820783b7755bca89f83a0fe096dbb510018dd65b63fc80bd20c03261 (SHA256) - Malicious DLL for sideloading
  • 27b7591cf9e1283010ca98fa5dbe970a73fee0d8cde277639924c144718db7c0 (SHA256) - Malicious DLL for sideloading
  • 37f94fe1b4a106f02b6f74a69cbc05e69c17406f688beef4c9a045ffcbd2e65e (SHA256) - Suspicious file
  • 6d07f1232dc59b84038fd0b2e75fdd3d5b825882bb0dba9e6724b7b0823fa3ad (SHA256) - Warlock ransomware binary
  • 8ce8d8270ee9de02644530b8dd7fa78973b4a3b80f121e2c5f45ae68cce196f9 (SHA256) - Warlock ransomware binary
  • 9ceb01f8bf7d6dba2ae07f5bd6070de3ec67b5eb01f969b0ba85e74564fb83a7 (SHA256) - Suspicious file
  • aaff04d84ef85353966aa4af186ff1254b72c068f33f802417b29dc23fb9f192 (SHA256) - Suspicious file
  • c46825fcc0d1bf7a8b192facb176d6bf916c9dccfd6fa994be691e3b0e585f4e (SHA256) - Malicious DLL for sideloading
  • e14240bac8277b0f6dd4d29ab5da20d246bcccae647e5fe8d19cdae7fe471b20 (SHA256) - Malicious DLL for sideloading
  • e3204b05e2f3a29bb6e6fcc21dda77d7cd31dfa755c21da0aa8661b5619ee0a1 (SHA256) - Suspicious file
  • eea631b5f7125239db0811e4682c2316ead69f9822e02d94fb5d8bf0d2faebed (SHA256) - Suspicious file
  • f7269f80f81e99d06a590d7ab374e12fdf7e5f55a02c2a46c342d670f8519fdf (SHA256) - Suspicious file
  • fb3846c9ac53d1b841ada3a6b1091153fea41a169cb44fe0084097d1f4d45984 (SHA256) - Malicious DLL for sideloading
• File Paths:
  • CSIDL_PROGRAM_FILES_COMMON\microsoft shared\web server extensions\14\template\layouts\layout2sp.aspx - Webshell dropped into SharePoint LAYOUTS directory
  • CSIDL_SYSTEM\0409\ - Subdirectory of Windows system folder for dropped executables
  • CSIDL_WINDOWS\debug\code-insiders.exe - VS Code Insiders binary installed for tunnel persistence
  • CSIDL_WINDOWS\SYSVOL\domain\scripts\run\ - SYSVOL path where Warlock ransomware was staged
• Command Lines:
  • Purpose: Drop webshell into SharePoint LAYOUTS directory via base64-decoded ASPX payload | Tools: powershell.exe | Stage: Initial Access | powershell -nop -c [IO.File]::WriteAllBytes(...)
  • Purpose: Enumerate Active Directory domain trust relationships | Tools: nltest.exe | Stage: Discovery | nltest.exe /domain_trusts
  • Purpose: Confirm code execution via Burp Collaborator OOB canary URL | Tools: powershell.exe | Stage: Discovery
  • Purpose: Load .NET assembly for ViewState deserialization RCE in SharePoint app pool | Tools: cmd.exe, powershell.exe | Stage: Execution
  • Purpose: Download and silently install MSI payloads from cloud hosting services | Tools: msiexec.exe | Stage: Execution | msiexec.exe /q /i
  • Purpose: Add masquerading domain service account to local Administrators group | Tools: net.exe | Stage: Privilege Escalation | net localgroup administrators <account> /add
  • Purpose: Install VS Code tunnel as Windows service for covert remote access | Tools: code-insiders.exe | Stage: Persistence | code-insiders.exe tunnel service install --accept-server-license-terms
  • Purpose: Map network share, copy AV/EDR killer tool, and execute it on remote hosts | Tools: cmd.exe, net.exe | Stage: Defense Evasion | cmd.exe /c net use \\<IP> & copy \\<IP>\av\* <dest> /y & start /B
  • Purpose: Copy Warlock ransomware from SYSVOL share and execute run.exe and rune.exe | Tools: cmd.exe | Stage: Impact | cmd.exe /c copy \\<SHARE>\SYSVOL\...\run\* <dest> /y & start /B
• Other:
  • run.exe - Warlock ransomware binary deployed via SYSVOL
  • rune.exe - Warlock ransomware binary deployed via SYSVOL
  • a.exe - AV/EDR killer tool using vulnerable driver
  • doexe.exe - DLL sideloading executable dropped by SharePoint worker
  • doexeloc.dll - Malicious DLL loaded via sideloading
  • ssvagent.exe - DLL sideloading executable in system folder
  • logger.exe - DLL sideloading executable in system folder
  • gsdll64.dll.tmp - Malicious DLL with .tmp extension for sideloading
  • doexeloc.dll.tmp - Malicious DLL with .tmp extension for sideloading
  • layout2sp.aspx - Webshell dropped in SharePoint LAYOUTS directory
  • nxc.exe - NetExec tool for AD enumeration and credential spraying