Warlock Ransomware Gang Switches Off Security Tools First, Then Strikes

On 1 October, threat researchers reported that the China-linked group behind Warlock ransomware, which Microsoft tracks as Storm-2603, had attacked at least four organisations in the previous two months. Victims included a water utility, a telecommunications provider, a regional government body and a university, all in Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America. The likely way in was on-premises Microsoft SharePoint. Researchers believe the group still carries exploits for the ToolShell flaws it used in July 2025, the month Microsoft released fixes, alongside newer SharePoint flaws.

One intrusion against a critical infrastructure operator shows the pattern. On 22 July, the attackers planted a web shell on a SharePoint server. Over the next week they mapped the network domain, set up covert remote access and added an account, apparently named to look like a SharePoint service account, to local administrator groups. For about a day, the only recorded activity was one piece of planted code running quietly in the background.

In the early hours of 31 July, they moved. A tool built to disable security software ran on at least 40 hosts within about two hours. The attackers then staged Warlock in the domain's SYSVOL share, which Windows replicates across domain controllers, and normal replication carried it to at least 33 hosts. On each one, the ransomware appeared almost as soon as protection was gone. The attackers went after the tools watching the data before the data itself.