Warlock ransomware, attributed to the China-linked group Longlegs, exploits a chain of zero-day Microsoft SharePoint vulnerabilities (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771) known as ToolShell to gain initial access to targeted networks. The group targets organizations in Portuguese and Spanish-speaking countries across Europe, Africa, and Latin America. After initial compromise, Warlock operators deploy a web shell compatible with multiple SharePoint versions and use a signed vulnerable driver (CVE-2025-1055) to disable AV/EDR protections on at least 40 hosts within hours. The ransomware payload is staged in the SYSVOL share to enable network-wide execution via Group Policy or logon scripts. Attackers also install Visual Studio Code Insiders as a service to enable remote control via VS Code tunneling and use tools like NetExec for Active Directory enumeration and credential spraying. Despite being known for over a year, ToolShell and related SharePoint vulnerabilities remain active attack vectors.

Successful exploitation allows the attacker to gain initial access to corporate networks by compromising on-premises SharePoint servers. This access enables deployment of tools that disable endpoint protection on dozens of hosts, facilitating widespread ransomware deployment. The ransomware encrypts data across multiple hosts, potentially disrupting critical services in targeted sectors such as water utilities, telecommunications, government, and education. The use of SYSVOL for payload distribution enables rapid propagation across domain controllers and networked systems, increasing the scale and impact of the attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance on the ToolShell SharePoint vulnerabilities and CVE-2025-1055. Organizations should prioritize applying official Microsoft security updates for SharePoint and related components once available. Until patches are applied, restrict access to SharePoint servers, monitor for signs of web shell deployment, and review Group Policy and SYSVOL shares for unauthorized changes. Since the threat actor uses a signed vulnerable driver to disable endpoint protection, ensure endpoint security solutions are updated to detect and block such techniques. Follow vendor guidance closely as Microsoft manages remediation for cloud services, but on-premises SharePoint deployments require direct patching.