China-linked Warlock actors disabled security tools before ransomware deployment

Actors tracked by Microsoft as Storm-2603 and described by researchers as China-linked planted a web shell on an on-premises SharePoint server at a critical infrastructure operator on July 22, 2026, then disabled security software on at least 40 hosts and deployed Warlock ransomware on at least 33 hosts on July 31, 2026.

The actors exploited several vulnerabilities in on-premises Microsoft SharePoint Server deployments and planted a web shell built to work across many SharePoint versions. The shell collected the farm’s ASP.NET machine keys, which the attackers used to forge a validly signed payload and run code inside the SharePoint application pool. They also installed Visual Studio Code Insiders as a service, using the application’s built-in tunneling capability for covert remote connections.

After planting the web shell, the attackers spent roughly a week mapping the domain and establishing covert remote access. They created an account meant to look like a SharePoint service account and added it to local administrator groups, and for about one day the only recorded activity was a single piece of planted code running in the background. Reconnaissance resumed on July 24, 2026, with net user /domain and whoami commands on a second SharePoint host, followed by the deletion of numerically named files from Public profile and ProgramData directories, including doexeloc.dll.

On July 24, 2026, the actors deployed ssvagent.exe and logger.exe alongside DLLs for DLL sideloading, which loads a malicious DLL through a legitimate application, and ran nltest /domain_trusts to list Active Directory domain trust relationships. A compromised host made an outbound web request to an oastify.com subdomain on July 27, 2026, using a per-target canary URL to confirm code execution. They also downloaded follow-on payloads from legitimate cloud file-sharing services such as catbox[.]moe and wasabisys[.]com. On July 28, 2026, they re-tested the web shell, began the exploitation chain with base64-encoded PowerShell commands, and ran msiexec against two URLs in quick succession before fetching a third package 80 minutes later.

On July 29, 2026, attackers repeatedly added a domain account named SPSEPRDSetup to the local Administrators group on three further hosts and installed Visual Studio Code Insiders as a service using its built-in tunnel feature on one host. The same day they ran NetExec for Active Directory enumeration, credential spraying, and remote command execution. Through July 30 and into early July 31, 2026, the only recorded activity was a side-loading pair reappearing on the first SharePoint host.

Early on July 31, 2026, attackers pushed the AV/EDR-killing tool to several hosts in rapid succession using a command that mapped a network share, and the command copied a local tool set and launched it. CyberScoop calculates that defenders lost protection on one machine every three minutes during the roughly two-hour disablement, and ransomware appeared almost immediately after the attackers disabled protection on every host.

Attackers placed Warlock ransomware in the domain’s SYSVOL share, where ordinary domain replication distributes payloads to every domain controller, staging the binaries for domain-wide deployment. The Distributed File System Replication service delivered run.exe and rune.exe from the SYSVOL path, with dfsrs.exe as the parent process, and the affected hosts also received a ransom note called how to restore your files.txt.

In August 2026, the actor had compromised at least four targets during the previous two months, including two critical infrastructure operators. The victims included a water utility, a telecommunications provider, a regional government body, and a university, all located outside the United States in Portuguese- and Spanish-speaking nations across Europe, Africa, and Latin America.

An August 2026 Congressional Research Service note states that 81% of nearly 49,500 community water systems across the United States qualify as small, meaning they serve 3,300 people or fewer. Larger systems have greater capacity to hire security specialists, and the situation likely means fewer people are watching at small utilities, with more hours passing with no one monitoring. Symantec notes that the inclusion of critical infrastructure operators among victims highlights potential real-world consequences when ransomware succeeds against essential services.

Microsoft tracks the ransomware cartel behind Warlock ransomware as Storm-2603, and researchers describe the actor as China-linked. Symantec tracks the same actor as Longlegs and identifies it as Gold Salem, and links Warlock, Storm-2603, and CL-CRI-1040 to older clusters including CamoFei and ChamelGang. China denies the allegations; the Chinese Embassy in Washington said, “China firmly opposes all forms of cyberattacks and smearing without solid evidence.”

Warlock emerged in June 2025 and gained notoriety in July 2025 after exploiting ToolShell zero-day vulnerabilities in Microsoft SharePoint, specifically CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771. Microsoft linked mass exploitation of SharePoint vulnerabilities to Chinese state-sponsored actors Linen Typhoon, Violet Typhoon, and Storm-2603 in July 2025. In February 2026, ReliaQuest tied Storm-2603 to attacks on SmarterMail servers through CVE-2026-23760 with moderate-to-high confidence, showing the actor used entry points besides SharePoint. Earlier Warlock activity hit organizations in the United States, Brazil, India, Russia, Taiwan, and Japan.

Organizations running on-premises Microsoft SharePoint Server reachable from the internet are at risk, while SharePoint Online tenants are not directly hit; hybrid setups running on-premises SharePoint stay exposed. Patching alone is insufficient because the campaign abuses both old and new flaws, so defenders must also hunt for pre-existing compromise. Defenders should patch immediately, apply the latest SharePoint cumulative updates, and verify builds against Microsoft guidance; CISA published an advisory about newer SharePoint flaws in July 2026.

Defenders should rotate ASP.NET machine keys after patching and restart IIS, since stolen keys enable forged ViewState payloads that survive patching. They should take SharePoint off the internet or put it behind a VPN or WAF and enable AMSI integration for SharePoint, which scans requests at the HTTP layer.

SharePoint servers should run tamper protection and EDR in block mode; the disabler works only when tamper protection is off or EDR coverage is absent. They should hunt for pre-existing compromise by reviewing IIS logs for anomalous POST requests and check for unauthorized service accounts and recently created local administrator accounts.

Defenders should restrict service account privileges so SharePoint farm and application pool accounts never hold Domain Admin rights, limiting blast radius from a compromised w3wp.exe. They should watch for encryption precursors such as shadow copy deletion, bcdedit recovery changes, and bursts of bulk file renames or writes.

Defenders should block vulnerable drivers such as K7RKScan, tracked as CVE-2025-1055, using Microsoft’s driver blocklist; DragonForce ransomware actors exploited the same driver. Watch for new executables in SYSVOL scripts folders, VS Code tunnels operating as server services, and local administrator accounts that copy SharePoint service names.