Warlock ransomware group widens SharePoint exploitation against critical infrastructure

The Warlock ransomware group is continuing to exploit SharePoint servers in attacks on critical infrastructure, government and education organisations, according to a Symantec report. The group is believed to be operated by a China-based hacking team tracked as Longlegs and Storm-2603, which has been linked to activity including CL-CRI-1040, CamoFei and ChamelGang.

Symantec said the operator has hit at least four victims in Portuguese- and Spanish-speaking countries over the past two months, among them a water utility, a telecommunications provider, a regional government body and a university. In one intrusion the group disabled security software on at least 40 systems and executed Warlock on at least 33 of them.

The group’s SharePoint exploitation is typically followed by webshell deployment, ASP.NET machine key exfiltration and a signed payload for remote code execution. Symantec also noted the use of DLL sideloading, a vulnerable driver to disable security tools, and abuse of Visual Studio Code’s tunnel feature to establish covert remote access, with the Warlock payload staged in the SYSVOL share for domain-wide execution.