Date: October 3, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Critical Infrastructure / Ransomware / Microsoft SharePoint / Enterprise Security / Threat Intelligence
Tags: Warlock, Longlegs, Gold Salem, Storm-2603, Microsoft SharePoint, ToolShell, EDR Blinding, Ransomware, Critical Infrastructure, BYOVD
Executive Summary
The boundary between state-sponsored cyber espionage and destructive cyber extortion blurred further on October 3, 2026, when the Symantec and Carbon Black Threat Hunter Team at Broadcom revealed that the suspected China-nexus threat actor known as Warlock has launched a targeted campaign against critical infrastructure and government entities across Latin America, Europe, and Africa. As reported by The Hacker News, Security.com, and AsumeTech, the threat group—also tracked under the monikers Gold Salem, Longlegs, and Storm-2603—has compromised at least four major organizations over the past 60 days, including a municipal water utility, a national telecommunications provider, a regional government agency, and an academic institution.
The attackers establish initial foothold by weaponizing vulnerabilities in on-premises Microsoft SharePoint servers, including the notorious "ToolShell" exploit chain and related deserialization flaws. Once inside corporate networks, Warlock systematically blinds host Endpoint Detection and Response (EDR) security tooling, executes deep Active Directory reconnaissance, and deploys custom Warlock ransomware across core operational servers.
This campaign underscores an alarming operational evolution: sophisticated threat actors historically associated with cyber espionage are increasingly leveraging destructive ransomware capabilities against essential public utilities and communications backbones.
Technical Deep-Dive: Deconstructing the Warlock Attack Chain
To understand how Warlock transitions from remote web application exploitation to full domain compromise and EDR neutralization, we examine the full attack lifecycle observed during forensic investigations.
Phase
Threat Actor Activity & Operational Mechanics
Target Infrastructure Impact
1. Initial Access
Crafting HTTP requests weaponizing SharePoint RCE & ToolShell flaws
Exploits exposed w3wp.exe process; drops primary web shells
2. EDR Blinding
Drops signed vulnerable kernel driver via BYOVD technique
Unhooks security filters; terminates Defender, CrowdStrike, Carbon Black, SentinelOne
3. Privilege & Movement
Extracts NTLM hashes via LSASS memory dumping
Moves laterally across network using WMI and WinRM administrative channels
4. Domain Dominance
Active Directory enumeration via custom scripts
Stages ransomware binaries on Domain Controller & Core Infrastructure
5. Ransomware Execution
Issues vssadmin delete shadows /all and starts multi-threaded encryption
Encrypts critical file streams; drops ransom demand notes on hosts
1. Initial Access: Exploiting Microsoft SharePoint
Microsoft SharePoint serves as the primary collaborative content platform for thousands of enterprise networks, making it a lucrative ingress vector:
* The Exploit Vector: Warlock targeted unpatched and exposed on-premises SharePoint installations utilizing remote code execution flaws within the SharePoint application pool. Previous iterations of Warlock’s toolkit weaponized the "ToolShell" flaw chain, which combined authentication bypasses with unsafe object deserialization in SharePoint’s HTTP endpoints.
* Payload Delivery: Successful exploitation allows arbitrary code execution within the context of the IIS worker process (w3wp.exe). The attackers immediately drop stealthy .NET-based web shells or backdoor DLLs into virtual directories, providing an interactive, persistent gateway into the perimeter network.
2. Defense Evasion: Systematic EDR Blinding (BYOVD)
A defining hallmark of the recent Warlock intrusions is the aggressive neutralization of host security agents before staging data exfiltration or ransomware:
* Bring Your Own Vulnerable Driver (BYOVD): To bypass user-mode and kernel-mode endpoint protections, Warlock deploys a legitimate, cryptographically signed third-party Windows kernel driver known to contain arbitrary memory read/write vulnerabilities.
* Process Termination: Operating with kernel-level ring 0 privileges granted by the vulnerable driver, the attacker's payload traverses the operating system's active process list, stripping process permissions, unhooking ETW (Event Tracing for Windows) telemetry providers, and terminating the service daemons of major EDR agents.
* Log Suppression: By blinding security agents and altering Windows Event Log services, the threat actors create a forensic blind spot, allowing subsequent lateral movement to proceed undetected by security operations center (SOC) analysts.
3. Credential Harvesting & Lateral Movement
With host defenses suppressed, the threat actors expand their reach throughout the target environment:
* LSASS Memory Dumping: Attackers utilize customized mini-dump routines or comsvcs.dll abuse to extract plaintext credentials and NTLM hashes from the Local Security Authority Subsystem Service (LSASS).
* Network Enumeration: Utilizing lightweight PowerShell commands, WMI, and native Windows utilities (nltest, net group "Domain Admins" /domain), the actors identify high-value targets, including hypervisors, backup repositories, and industrial control management jump hosts.
* Staging Payloads: The actors leverage native administrative channels such as SMB, Windows Remote Management (WinRM), and Scheduled Tasks to distribute payloads across the network.
4. Warlock Ransomware Deployment & Impact
The intrusion culminates in the widespread execution of the custom Warlock ransomware:
* Inhibition of System Recovery: Prior to initiating encryption, the malware issues commands to destroy backup snapshots and prevent restoration:
vssadmin.exe delete shadows /all /quiet
wbadmin.exe delete catalog -quiet
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
bcdedit.exe /set {default} recoveryenabled no
* High-Speed Encryption: The ransomware leverages a hybrid cryptographic scheme (combining AES/ChaCha20 for file stream encryption with an RSA/ECC public key to seal session keys). It targets critical databases, virtual machine disks (.vmdk, .vhdx), and operational configuration files, appending a specific extension and depositing extortion instructions across every compromised directory.
* Critical Infrastructure Disruption: In the attacked water utility and telecommunications provider, disruption of operational management systems forced staff to temporarily resort to manual failover procedures to prevent service outages.
Industry Impact & The Dual Espionage-Extortion Paradigm
The activity of Warlock highlights critical shifts in the threat landscape:
* Hybrid Threat Actor Motivation: While Warlock exhibits hallmarks and operational overlaps with Chinese advanced persistent threat (APT) groups focused on strategic intelligence gathering, the deployment of ransomware indicates that state-sponsored operators are increasingly engaging in financial extortion, disruptive deniable attacks, or secondary commercial monetization of breached access.
* Perimeter Vulnerability Risk: On-premises collaboration tools like SharePoint remain chronic single-points-of-failure. Organizations that delay patching or fail to isolate web-tier infrastructure risk catastrophic compromise of their entire Active Directory estate.
Defensive Hardening Blueprint & Mitigations
Organizations operating Microsoft SharePoint or managing critical infrastructure must implement the following defensive measures immediately:
1. Patch and Isolate Microsoft SharePoint
* Ensure all Microsoft SharePoint servers are updated with the latest Cumulative Updates (CUs) and security patches provided by Microsoft.
* Place SharePoint servers behind a Web Application Firewall (WAF) configured to inspect HTTP request bodies and block known deserialization exploit patterns.
* Segment SharePoint servers into a dedicated DMZ VLAN, strictly restricting outbound connections to internal Active Directory controllers and database clusters.
2. Neutralize BYOVD Attacks with Driver Blocklists
* Enable Hypervisor-Protected Code Integrity (HVCI) and Memory Integrity across all Windows endpoints and servers.
* Enable the Microsoft Vulnerable Driver Blocklist (enforced via Windows Defender Application Control / WDAC) to block known vulnerable signed drivers from loading into kernel memory.
3. Threat Hunting & Detection Engineering
Configure SIEM and EDR detection rules to flag the following indicators:
* Process Lineage Alerts: Flag any occurrence of w3wp.exe spawning command interpreters or script hosts:
* Parent: w3wp.exe -> Child: cmd.exe, powershell.exe, certutil.exe, or rundll32.exe.
* Shadow Copy Deletion: Alert on any execution of vssadmin.exe delete shadows or wbadmin.exe delete catalog.
* Abnormal Service Stopping: Alert on bulk termination of anti-malware services or unexpected driver installations (Event ID 7045: A new service was installed in the system).
________________
For technical threat intelligence briefings, ransomware incident analyses, and infrastructure hardening guides, subscribe to Digital Spying.