Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack

The Warlock ransomware group has enhanced its attack chain with improved methods for persistence, lateral movement, and evasion. Their updated toolset includes TightVNC, Yuze, and a persistent BYOVD technique exploiting the NSec driver. The group's primary targets were technology, manufacturing, and government sectors, with the US, Germany, and Russia being the most affected countries. Warlock continues to exploit unpatched Microsoft SharePoint servers for initial access, and has expanded its post-exploitation toolkit. New additions include TightVNC for persistent remote access, Yuze for establishing SOCKS5 connections, and a BYOVD technique using the NSecKrnl.sys driver to terminate security products. The group also leverages Velociraptor, VS Code tunnels, and Cloudflare Tunnel for C&C communications.

• Bulletproof Host Virtualine Loses Its Domain to FBI SeizureNews2026-10-30
• Aurora ransomware targets ESXi abuses Cursor Agent for exploitationMalware2026-10-29
• A quiet week in infosec <.<HighVulnerability2026-10-29
• IDC MarketScape names Microsoft a Leader in the 2026 Worldwide Modern Endpoint Security for Enterprises Vendor AssessmentNews2026-10-29
• NIK C2: The new AI-enabled command-and-control frameworkMalware2026-10-29