Published on DigitalSpying.com | October 4, 2026
Author: DigitalSpying Threat Research Team
Threat Classification: Critical Infrastructure Cyberattack | Hybrid APT-Ransomware | EDR Neutralizatio
n
Executive Summary
The boundary between state-sponsored cyber espionage and destructive ransomware extortion has collapsed. In a series of coordinated intrusions detailed in alerts from BleepingComputer, The Hacker News, and Symantec Threat Hunter Team, the China-nexus threat group known as Warlock (tracked by researchers as Longlegs, Storm-2603, or Gold Salem) has unleashed a devastating wave of cyberattacks against critical infrastructure organizations.
Targeting municipal water utilities, national telecommunications operators, regional governments, and higher education institutions, the threat actor weaponizes on-premises Microsoft SharePoint vulnerabilities to gain initial access. Once inside, Warlock steals SharePoint farm ASP.NET machine keys, tunnels back in using developer tooling, neutralizes Endpoint Detection and Response (EDR) software using a Bring-Your-Own-Vulnerable-Driver (BYOVD) exploit, and distributes ransomware domain-wide using Active Directory’s native SYSVOL file-sharing replication. Most alarming for defenders: standard software patching fails to evict the adversary, because stolen cryptographic machine keys allow attackers to forge valid authentication sessions indefinitely.
Technical Deep-Dive: Deconstructing Warlock's Five-Stage Kill Chain
1. Initial Access: SharePoint Exploitation & The Farm Key Trap
Warlock's primary ingress vector relies on on-premises Microsoft SharePoint Server deployments exposed to external networks. Attackers exploit chains of deserialization and code injection flaws (including the historic ToolShell suite and recently disclosed flaws such as CVE-2026-65660):
* Web Shell Deployment: Upon exploiting the SharePoint HTTP endpoint, the actor deploys a cross-version web shell directly within the SharePoint virtual directory.
* MachineKey Exfiltration: The web shell extracts the SharePoint farm's global ASP.NET MachineKeys (validationKey and decryptionKey) stored within the configuration database and web.config.
* The Persistence Anchor: Even if administrators subsequently install Microsoft’s latest cumulative updates, any attacker holding the farm's validationKey can independently construct signed, arbitrary serialized ViewState payloads, regaining administrative remote code execution at will.
[External Attacker]
│
│ 1. Exploits SharePoint Deserialization Flaw
▼
[On-Premises SharePoint Server]
│
│ 2. Drops Web Shell & Extracts ASP.NET MachineKeys
▼
[Active Directory Domain Reconnaissance]
│
│ 3. Installs VS Code Insiders Tunnel Service & Runs NetExec
▼
[Kernel-Level Defense Neutralization]
│
│ 4. Deploys BYOVD Exploit (Signed K7RKScan Driver CVE-2025-1055)
│ Terminates EDR & Antivirus on 40+ Hosts in ~2 Hours
▼
[Domain-Wide Ransomware Detonation]
│
│ 5. Stages Warlock Encryptor in Domain SYSVOL Share
▼
[All Domain-Joined Hosts Encrypted via Automated Group Policy Replication]
2. Operational Foothold & Living-off-the-Land (LotL)
To avoid tripping behavioral detections during lateral movement:
* Developer Tunnels for C2: Instead of deploying recognizable command-and-control (C2) agents like Cobalt Strike, Warlock installs Visual Studio Code Insiders as a persistent Windows service. Leveraging VS Code's legitimate remote development capability (code tunnel), the actor establishes persistent, outbound-encrypted reverse tunnels over Microsoft infrastructure, completely bypassing egress firewall restrictions.
* Internal Enumeration: The group uses NetExec (formerly CrackMapExec) for rapid, automated Active Directory enumeration, identifying domain controllers, service accounts, and administrative workstations.
3. EDR Neutralization via BYOVD (CVE-2025-1055)
To ensure the ransomware deployment encounters zero resistance, Warlock conducts automated defense neutralization:
* Weaponizing Signed Drivers: The attackers drop a legitimately signed, legacy driver from K7 Computing (K7RKScan.sys, vulnerable to CVE-2025-1055).
* Arbitrary Kernel Write: Because the driver possesses a valid cryptographic signature, Windows allows it to load. The exploit abuses the driver’s IOCTL interface to write arbitrary memory into kernel space, systematically stripping process protections (Protected Process Light / PPL) from running EDR and antivirus agents (such as CrowdStrike, Defender for Endpoint, and SentinelOne) and terminating them.
* In documented forensic casefiles, Warlock neutralized security agents across over 40 enterprise servers in approximately two hours.
4. Mass Distribution via Active Directory SYSVOL
Rather than executing lateral movement host-by-host:
* The actor places the compiled Warlock ransomware executable into the domain’s SYSVOL share (e.g., \\
* By scheduling a task through Group Policy Objects (GPO), Windows Domain Controllers automatically replicate the encryptor across every subnet.
* Within minutes, all domain-joined endpoints pull the payload from their local domain controller and execute the ransomware simultaneously, locking out operators and crippling telemetry.
Industry & Geopolitical Impact: Critical Infrastructure in the Crosshairs
The targeting profile of Warlock marks a serious geopolitical escalation:
* Physical Sector Disruption: Municipal water treatment facilities and regional telecommunication backbones rely on operational uptime. By locking out administrative networks and SCADA telemetry bridges, Warlock creates direct life-safety and societal risks.
* Extortion as Hybrid Cover: The deployment of ransomware by an actor possessing nation-state espionage capabilities suggests that extortion may serve a dual purpose: generating untraceable funding while simultaneously providing plausible deniability for destructive state-aligned disruption.
Strategic Mitigation & Remediation Roadmap
For critical infrastructure operators, healthcare networks, and enterprise IT teams, addressing Warlock requires architectural hygiene far beyond basic software patching:
1. Remediate SharePoint and Rotate MachineKeys (Mandatory)
* Patch On-Premises Instances: Apply all recent Microsoft SharePoint security patches immediately.
* Rotate ASP.NET MachineKeys: If an on-premises SharePoint server has been exposed to the internet during 2025–2026, assume the farm MachineKeys are compromised. Administrators must follow Microsoft’s automated scripts to generate fresh validationKey and decryptionKey pairs across the entire farm.
* Pre-Key-Rotation Forensics: Conduct an intensive web shell sweep of all virtual directories (_layouts, wpresources) before rotating keys; otherwise, active web shells can immediately capture the newly generated keys.
2. Block Vulnerable Drivers with WDAC
* Enable the Microsoft Recommended Driver Block Rules and enforce Windows Defender Application Control (WDAC) or AppLocker in enforce mode.
* Block the loading of vulnerable kernel drivers, specifically K7RKScan.sys and other known BYOVD tools listed on the LOLDrivers repository.
3. Restrict and Audit Developer Reverse Tunnels
* Audit endpoints for unauthorized installations of code.exe, VS Code Insiders, or unexpected services running with names containing "tunnel".
* Enforce network boundary filtering blocking DNS resolution and connections to .tunnels.api.visualstudio.com on production servers.
4. Secure the SYSVOL Share & Monitor GPO Modifications
* Restrict write access to SYSVOL and NETLOGON shares strictly to Tier-0 Domain Admins.
* Implement SIEM alerts for any newly created .bat, .ps1, .exe, or .dll files placed within domain policy script folders.
References & Threat Intelligence
* BleepingComputer: Warlock Ransomware Breach SharePoint in Water, Telecom Operator Attacks
* The Hacker News: Warlock Exploits SharePoint Flaws to Disable Security Tools
* Symantec Protection Bulletin: Warlock Targets Water and Telecom Operators
* Aviatrix Threat Research Center: Warlock Ransomware Exploits SharePoint in Critical Infrastructure