Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware

Symantec and Carbon Black researchers report that the China-linked group Warlock, also known as Gold Salem, Longlegs, and Storm-2603, is still actively abusing vulnerabilities in on-premises Microsoft SharePoint Server, including the older ToolShell flaws, to breach organizations. Over the past two months the actor has hit at least four victims in Portuguese- and Spanish-speaking regions across Europe, Africa, and Latin America, among them a water utility, a telecom provider, a regional government, and a university. After gaining access, the attackers drop web shells to steal ASP.NET machine keys for forging signed code-execution payloads, then use living-off-the-land tools, VS Code tunnels, and the vulnerable K7RKScan.sys driver (CVE-2025-1055) in a BYOVD attack to disable security software before pushing ransomware at scale through the domain's SYSVOL share. Analysts warn this shows unpatched SharePoint servers remain a reliable entry point for attackers more than a year after Warlock first emerged.