Warlock is a ransomware operation that breaks in through internet-facing servers, most famously on-premises SharePoint through the July 2025 ToolShell chain, steals machine keys and domain credentials, switches off endpoint protection and then pushes its encryptor domain-wide through Group Policy or the SYSVOL share. Microsoft tracks the operator as Storm-2603 and assesses with moderate confidence that it is China-based; Sophos tracks the same activity as GOLD SALEM and Symantec as Longlegs. The group first surfaced publicly in June 2025 and was still active in late 2026, when Symantec reported intrusions against a water utility, a telecommunications provider, a regional government body and a university. This profile is for SOC analysts, Windows and SharePoint administrators and incident responders. It covers names and attribution, targeting, ATT&CK techniques, how the group abuses accounts and keys, a dated timeline and a prioritised defence plan. The SharePoint exploitation itself is analysed in the ToolShell SharePoint Exploitation 2025 breach page; this page covers what is specific to Warlock and its operator.
Key takeaways
- Edge servers are the way in. Microsoft, Sophos and Symantec all document exploitation of on-premises SharePoint (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771), and ReliaQuest saw the same operator use a SmarterMail authentication bypass (CVE-2026-23760) in February 2026.
- Patching without rotating keys is not enough. The group harvests ASP.NET machine keys from web.config, which lets it forge signed ViewState and return after the fix. Microsoft and Unit 42 both tell defenders to rotate keys and restart IIS.
- Legitimate tools carry the intrusion. Velociraptor, Visual Studio Code tunnels, PsExec, Impacket, NetExec and cloud file hosts appear across reports, so detection must focus on who runs a tool and from which parent process.
- Security tools are killed at kernel level. Check Point, Sophos and Symantec describe custom EDR killers paired with vulnerable signed drivers, run on dozens of hosts within hours before encryption.
- Deployment rides on domain infrastructure. Microsoft saw Group Policy Objects modified to distribute Warlock, and Symantec saw binaries staged in the SYSVOL scripts share and replicated by DFSR, so Tier 0 hygiene decides the blast radius.
Who they are (names, aliases and attribution)
Names in this table are taken from each reporting organisation's own research. Attribution confidence is quoted as the source states it; NHI Mgmt Group makes no attribution of its own.
| Name | Used by | What it refers to and how confident |
|---|---|---|
| Storm-2603 | Microsoft Threat Intelligence | The operator. Microsoft assesses with moderate confidence that it is a China-based threat actor, has not linked it to other known Chinese actors and could not confidently determine its objectives. Storm is Microsoft's prefix for groups still in development. |
| GOLD SALEM | Sophos Counter Threat Unit (CTU) | The group that runs the Warlock operation. CTU says it has insufficient evidence to corroborate Microsoft's China assessment. |
| Longlegs | Symantec Threat Hunter Team | Described as a China-nexus actor that develops Warlock. Symantec has previously linked it to CL-CRI-1040, CamoFei and ChamelGang. |
| CL-CRI-1040 | Palo Alto Networks Unit 42 | An activity cluster that Unit 42 assesses with high confidence is related to Storm-2603, based on overlapping host and network artefacts with Microsoft's ToolShell reporting. Unit 42 does not attribute it to a nation state. |
| Warlock (x2anylock) | Check Point, Sophos, Microsoft | The encryptor. Sophos says it is based on the leaked LockBit 3.0 builder; Check Point tracked an early form as X2anylock, after its file extension. |
| SharePoint ToolShell Exploitation (C0058) | MITRE ATT&CK | The July 2025 campaign in which Storm-2603 and two espionage groups exploited the ToolShell flaws. ATT&CK v20 records it as a campaign rather than giving Storm-2603 a group entry. |
The operator has also deployed LockBit Black and Babuk alongside Warlock. Check Point described one installer that dropped Warlock, LockBit Black and x2anylock together through DLL hijacking, which it called rarely seen among established groups. For how brands share builders and split, see the Ransomware Family Lineage and Rebrands Guide, and for the wider landscape the Ransomware Groups Guide.
Targeting and motivation
- Opportunistic edge exploitation: the group advertised on the RAMP forum in June 2025 for exploits against enterprise applications such as Veeam, ESXi and SharePoint and for tools that kill EDR (Sophos). Victims are reached wherever an exploitable internet-facing server exists.
- Broad sectors and geography: MITRE's C0058 entry lists finance, education, energy and healthcare across Asia, Europe and the United States. Sophos counted 60 published victims by mid-September 2025, from small commercial and government bodies to multinationals in North America, Europe and South America. Check Point found likely Latin American and APAC targets in the first half of 2025.
- Critical infrastructure in 2026: Symantec reported at least four organisations attacked between August and October 2026, in Portuguese and Spanish-speaking countries across Europe, Africa and Latin America, including water and telecommunications operators.
- Motivation: financial extortion. ATT&CK records ransom demands both for decryption and for not publishing stolen data. Sophos notes a Tor leak site with a countdown of typically 12 to 14 days, and treats the group's claims to have sold victim data privately as likely embellished.
- Unclear wider purpose: because an actor assessed as China-based running ransomware is unusual, Microsoft says it cannot yet determine the group's objectives. Treat any intrusion as possibly having data theft goals beyond the ransom.
Tactics and techniques (MITRE ATT&CK)
Built from ATT&CK v20 campaign C0058 and the Microsoft, Sophos, Check Point, Symantec and ReliaQuest reports. Every ID was checked against the v20 dataset.
| Tactic | Technique | Warlock and Storm-2603 behaviour |
|---|---|---|
| Reconnaissance | T1595.002 Vulnerability Scanning | Scanning for SharePoint servers vulnerable to CVE-2025-53770; Unit 42 saw requests to /_layouts/15/ToolPane.aspx in the same order as later exploitation. |
| Initial access | T1190 Exploit Public-Facing Application | ToolShell chain on SharePoint; SmarterMail password reset bypass CVE-2026-23760 (ReliaQuest). |
| Execution | T1059.001 PowerShell; T1059.003 Windows Command Shell; T1047 WMI; T1569.002 Service Execution | Encoded PowerShell launched by w3wp.exe; batch scripts; WMI and PsExec for remote execution. |
| Persistence | T1505.003 Web Shell; T1505.004 IIS Components; T1053.005 Scheduled Task; T1136 Create Account | spinstall0.aspx and later layout2sp.aspx; malicious .NET IIS module; scheduled tasks; new local administrator accounts. |
| Privilege escalation | T1068 Exploitation for Privilege Escalation; T1484.001 Group Policy Modification | Vulnerable signed drivers loaded for kernel access; GPO changes to distribute the encryptor. |
| Defense impairment | T1685 Disable or Modify Tools; T1112 Modify Registry | Microsoft Defender disabled through registry edits and PowerShell; EDR killers on 40 or more hosts in one 2026 intrusion. |
| Stealth | T1574.001 DLL; T1027.010 Command Obfuscation | DLL side-loading through legitimate executables; Base64-encoded commands. |
| Credential access | T1552.001 Credentials In Files; T1003.001 LSASS Memory | MachineKey values read from web.config and machine.config; Mimikatz and comsvcs.dll MiniDump against LSASS; a Veeam password dumper (Sophos). |
| Discovery | T1033 System Owner/User Discovery; T1087.002 Domain Account; T1482 Domain Trust Discovery | whoami, net user /domain and nltest /domain_trusts; NetExec for Active Directory enumeration. |
| Lateral movement | T1570 Lateral Tool Transfer; T1021.002 SMB/Windows Admin Shares | Impacket and PsExec staging payloads on remote hosts; SYSVOL used as a distribution point. |
| Command and control | T1219.001 IDE Tunneling; T1572 Protocol Tunneling; T1090 Proxy | Visual Studio Code tunnels (code.exe, code-insiders.exe as a service); ngrok and Cloudflared; a fast reverse proxy; Velociraptor configured to an attacker server. |
| Exfiltration and impact | T1041 Exfiltration Over C2 Channel; T1486 Data Encrypted for Impact; T1657 Financial Theft | Credentials and data sent over HTTPS; Warlock, LockBit and Babuk (ESXi) encryption; double extortion. |
ATT&CK v20 places registry and tool tampering under the Defense Impairment tactic (TA0112) and side-loading under Stealth. For the full technique pages see the MITRE ATT&CK T1484 Domain or Tenant Policy Modification Guide.
How they abuse identities, keys and credentials
Warlock intrusions convert one exposed server into domain control through a chain of non-human and privileged credentials. Each link is a place to break the chain.
Machine keys as long-lived secrets
The ToolShell web shells existed to read the ASP.NET ValidationKey and DecryptionKey. With them the attacker can sign their own ViewState payloads and run code in the SharePoint application pool even after the vulnerability is patched. Symantec saw exactly this again in July 2026 with a web shell named layout2sp.aspx. Treat machine keys as secrets with a rotation runbook: Microsoft documents rotation with the Set-SPMachineKey PowerShell cmdlet or the Machine Key Rotation Job in Central Administration, followed by iisreset on every server. See the ASP.NET Machine Key Exposure Guide.
Service account look-alikes and throwaway local admins
Symantec observed a domain account named to mimic a SharePoint service account pattern being added to local Administrators on several hosts. Sophos saw local administrator accounts such as backupadmin and admin_gpo created with a trivial password, and an account named lapsadmin1 added to Administrators, a name chosen to look like Windows LAPS. New accounts whose names resemble legitimate service or LAPS accounts should page someone, because naming is the camouflage.
Application pool and mail service identities
Commands ran as the IIS worker process (w3wp.exe) and, in the SmarterMail case, as MailService.exe. Whatever those service identities can reach, the attacker reaches. Run them as low-privilege accounts, never as domain accounts with administrative rights, and deny them interactive and network logon elsewhere. See the SharePoint Server Security Guide.
Credential dumping and backup credentials
Mimikatz against LSASS, comsvcs.dll MiniDump and a Veeam credential dumper give the group domain and backup administrator secrets. Microsoft's hardening list includes LSA protection, Credential Guard and the attack surface reduction rule that blocks credential stealing from LSASS. Backup consoles should use separate credentials that are not stored on domain-joined servers.
Dated timeline
| Date | Event | Source |
|---|---|---|
| Late 2024 | The Antivirus Terminator EDR killer, later tied to Storm-2603, is in the wild. | Check Point |
| March 2025 | Group activity and ransomware deployment begin; infrastructure in use since this month. | Sophos, Check Point |
| June 2025 | RAMP forum posts announce Warlock and seek exploits and initial access brokers; first Tor leak site appears on 10 June. | Sophos |
| 17 to 19 July 2025 | Unit 42 observes first CVE-2025-53770 exploitation on 17 July; Microsoft publishes CVE-2025-53770 and CVE-2025-53771 on 19 July. | Unit 42, Microsoft |
| 18 July 2025 | Storm-2603 begins deploying ransomware through the SharePoint flaws. | Microsoft |
| 20 and 22 July 2025 | CISA adds CVE-2025-53770, then CVE-2025-49704 and CVE-2025-49706, to the Known Exploited Vulnerabilities catalogue, each now marked as known ransomware use. | CISA KEV |
| 23 July 2025 | Microsoft updates its blog to report Warlock deployment by Storm-2603. | Microsoft |
| August 2025 | Velociraptor abused to create VS Code tunnels as a ransomware precursor. | Sophos |
| February 2026 | SmarterMail CVE-2026-23760 exploited to stage Velociraptor; attack stopped before encryption. | ReliaQuest |
| July to October 2026 | Intrusions against water, telecoms, government and education organisations; SYSVOL staging and code-insiders.exe tunnels. | Symantec |
Indicators: what to hunt and where to get them
Hashes and domains rotate quickly. Sophos noted the group moved staging infrastructure three days after its own Velociraptor research was published, so take current indicator lists from the reporting organisations and hunt primarily on behaviour.
| Indicator type | What to look for | Where published |
|---|---|---|
| File artefacts | Encrypted file extensions .x2anylock or .xlockxlock; ransom notes named "How to decrypt my data" (.log or .txt) or "how to restore your files.txt"; encryptors named after the victim. | Sophos, Check Point, Symantec |
| Web shells | New .aspx files in the SharePoint LAYOUTS directory, such as spinstall0.aspx or layout2sp.aspx. | Microsoft, Unit 42, Symantec |
| Process lineage | w3wp.exe or MailService.exe spawning cmd.exe, powershell.exe or msiexec.exe. | Microsoft, Unit 42, ReliaQuest |
| Tunnels and remote tools | code.exe or code-insiders.exe with tunnel arguments or installed as a service; Velociraptor installed outside the incident response team's own deployment; Cloudflared, ngrok, Radmin. | Sophos, Symantec |
| Drivers | New kernel services loading signed but vulnerable drivers such as ServiceMouse.sys, rsndispot.sys or K7RKScan, followed by security agents stopping. | Check Point, Sophos, Symantec |
| Domain changes | New executables in SYSVOL scripts, GPO edits adding scheduled tasks or startup items, new members of local Administrators. | Microsoft, Symantec |
| Hash and network IOCs | Current lists only. | Microsoft July 2025 blog, Sophos GOLD SALEM posts, Symantec October 2026 post, ReliaQuest February 2026 post |
Detection and defence: a prioritised plan
- Find and fix exposed servers first: list every internet-reachable SharePoint, mail and backup server. Run only supported SharePoint versions with Microsoft's ToolShell updates (KB5002768 for Subscription Edition; KB5002754 with KB5002753 for 2019; KB5002760 with KB5002759 for 2016). Upgrade SmarterMail to Build 9511 or later. If a server does not need to face the internet, remove the exposure or put it behind an authenticated gateway or VPN. See the Patch Management Guide.
- Assume compromise on anything that was exposed and unpatched: Unit 42 states plainly that patching alone is insufficient. Rotate machine keys, restart IIS, reset credentials the server held and hunt for web shells and IIS modules before declaring the server clean.
- Turn on the server-side guardrails: enable AMSI integration in SharePoint in Full Mode (on by default since the September 2023 update for 2016 and 2019 and version 23H2 for Subscription Edition), run antivirus and EDR on every SharePoint server, and turn on tamper protection so registry changes cannot disable it.
- Block the driver route: enforce the Microsoft vulnerable driver blocklist and application control for drivers, and alert on new kernel services. See the Bring Your Own Vulnerable Driver and EDR Killers Guide, and for live response the EDR Tampering and BYOVD Response Playbook.
- Control dual-use tools: allow Velociraptor, VS Code tunnels, Cloudflared and remote administration tools only on named hosts for named teams. Alert on tunnel creation from servers, and block outbound traffic from SharePoint and mail servers to everything except the protocols they need. See the Velociraptor Guide.
- Protect the deployment channels: alert on GPO creation and edits (Windows event 5136 on group policy containers with directory service change auditing) and on new files in SYSVOL, and limit who can edit GPOs. See the Group Policy Security Guide.
- Keep recovery out of reach: immutable or offline backups with separate credentials, and a tested restore. Use the Ransomware Playbook Template to rehearse the response.
Metrics that show the defences are working
- Exposure: number of internet-facing SharePoint and mail servers, and the share on current security updates within the patch target.
- Key hygiene: days since the last machine key rotation on each SharePoint farm, with a rotation after every critical update or suspected compromise.
- Tamper coverage: percentage of servers with tamper protection on and the vulnerable driver blocklist enforced.
- Dual-use tool inventory: count of hosts running remote access, tunnel or DFIR agents that are not on the approved list (target zero).
- Time to detect: median minutes from a web shell or GPO change alert to triage, measured in exercises.
Common failure patterns
- Patched but not rotated: servers updated without rotating machine keys stayed open to forged ViewState, the central lesson of the ToolShell SharePoint Exploitation 2025.
- Unpatched for a year: Symantec found ToolShell still providing initial access in July 2026, a year after fixes shipped, which points to forgotten on-premises farms.
- Trusting signed binaries: Microsoft-signed VS Code, a real DFIR tool and signed drivers were all used against defenders. Signature checks alone do not separate admin use from attacker use.
- Mail and collaboration servers on the domain with broad egress: ReliaQuest's advice to isolate mail servers in a DMZ and restrict outbound protocols reflects how much these servers can reach once compromised.
- Unmonitored GPO and SYSVOL changes: a single Group Policy or SYSVOL change gave the group domain-wide deployment, yet these changes are often not alerted on.
Framework mapping
| Defence | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | CIS Controls v8.1 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|---|
| Find and patch exposed servers | ID.RA-01, PR.PS-02 | SI-2 | Control 7 Continuous Vulnerability Management | A.8.8 |
| Rotate machine keys and service credentials | PR.AA-05 | IA-5 | Control 5 Account Management | A.5.17 |
| EDR, AMSI and tamper protection | DE.CM-09 | SI-3, SI-4 | Control 10 Malware Defenses | A.8.7 |
| Restrict dual-use tools and egress | DE.CM-01 | CM-7, SC-7 | Control 2 Inventory and Control of Software Assets | A.8.19, A.8.20 |
| Least privilege for service identities and GPO editors | PR.AA-05 | AC-6 | Control 6 Access Control Management | A.8.2 |
| Contain and recover | RS.MI-01, PR.DS-11 | IR-4, CP-9 | Control 11 Data Recovery; Control 17 Incident Response Management | A.5.26, A.8.13 |
Practitioner checklist
- Inventory every internet-facing SharePoint, mail and backup server and confirm it is supported and fully patched.
- Rotate ASP.NET machine keys and restart IIS on every SharePoint server that was exposed before patching.
- Hunt LAYOUTS directories for unexpected .aspx files and IIS for unknown modules.
- Enable SharePoint AMSI Full Mode, EDR and tamper protection on all SharePoint servers.
- Enforce the vulnerable driver blocklist and alert on new kernel services.
- Approve Velociraptor, VS Code tunnels and remote access tools per host, and alert on everything else.
- Alert on GPO edits, new SYSVOL executables and new local administrator accounts, especially names that imitate service or LAPS accounts.
- Run SharePoint and mail service identities with least privilege and restricted egress.
- Keep immutable backups with separate credentials and test a domain-wide restore.
Standards and references
- Microsoft Threat Intelligence: Disrupting active exploitation of on-premises SharePoint vulnerabilities
- MITRE ATT&CK: SharePoint ToolShell Exploitation (C0058)
- CISA: Known Exploited Vulnerabilities Catalog
- Sophos CTU: GOLD SALEM tradecraft for deploying Warlock ransomware
- Sophos CTU: GOLD SALEM's Warlock operation joins busy ransomware landscape
- Check Point Research: Before ToolShell, exploring Storm-2603's previous ransomware operations
- Symantec Threat Hunter Team: Warlock ransomware attacks on critical infrastructure
- Palo Alto Networks Unit 42: Active exploitation of Microsoft SharePoint vulnerabilities
Related NHI Mgmt Group resources: Ransomware Groups Guide · SharePoint Server Security Guide · ASP.NET Machine Key Exposure Guide · Bring Your Own Vulnerable Driver and EDR Killers Guide