Warlock exploited SharePoint in critical attacks

Operation timeline

Attack chain and TTPs

The intrusion shows a coherent post-exploitation chain with several linked objectives. First came entry into on-premises SharePoint. Then the attackers extracted farm secrets, specifically the ASP.NET machine keys, which let them forge valid payloads and bypass integrity controls. After that, they used deserialization via System.Workflow.ComponentModel with __VIEWSTATE, a technique that enabled code execution inside SharePoint’s application pool.

From there, the attackers sought visibility into the environment. The commands net user /domain, whoami and nltest /domain_trusts fit domain reconnaissance and trust validation. During the same period, numeric-named files were deleted and binaries were staged with names such as ssvagent.exe, logger.exe, gsdll64.dll.tmp, doexeloc.dll.tmp, doexe.exe and doexeloc.dll. The sequence suggests staging and preparation of supporting components before the more aggressive phases.

The installation of the Visual Studio Code Insiders tunnel as a service on July 29 stands out as a useful defensive indicator. The source interprets it as persistence and covert remote access. Operationally, the attacker did not rely only on web shells or exposed credentials. They also added a path that could survive reboots and hide traffic under a legitimate development product. That mix makes simple signature-based detection harder.

The next step was disabling protections. On July 31, a.exe was distributed from an internal share and ran on at least 40 hosts in about two hours. The source describes it as a tool for terminating antivirus and EDR processes. In parallel, abuse of K7RKScan was documented as a BYOVD technique. Using a signed but vulnerable driver raises the detection burden because malicious activity happens at kernel level and can evade user-space controls.

The final ransomware deployment was fast. That same July 31, run.exe, rune.exe and the note how to restore your files.txt appeared. Symantec and Carbon Black recorded Warlock on at least 33 hosts after protections had been disabled. The ransomware was also placed in SYSVOL, which replicates across domain controllers and is readable throughout the domain, making large-scale spread possible without copying the binary host by host. On three additional hosts, dfsrs.exe appeared as the parent process for the delivery of run.exe and rune.exe, consistent with distribution through ordinary SYSVOL replication.

Regional impact

The source allows a geographic outline, but not the identification of a specific Latin American victim. The recent campaign affected, according to Symantec and Carbon Black, at least four organizations in Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America. That regional framing is enough to speak of broad exposure, but not to assign a country or company to any of the victims.

Regional overview

The most important point is the difference between regional presence and individual victimology. The main report names Brazil as a country where Warlock had previously been seen, but not as a confirmed destination of the recent wave. In practice, that prevents a claim that a Brazilian, Argentine, Chilean, Mexican or other Latin American company was one of the four victims reconstructed by Symantec and Carbon Black.

The sectoral picture is clear. There was a water company and a telecom provider, both described as critical infrastructure operators, as well as a regional government entity and a university. The mix of sectors points to tactical opportunity, not a single vertical. It also shows that Warlock does not limit itself to high-profile financial targets, moving comfortably between essential services, the public sector and academia.

The aggregated geographic attribution also explains why the country names were not published. The source itself preserves victim anonymization. Security Affairs later repeated that Brazil appears among countries previously reached by Warlock activity, but reiterated that the recent victims were described by sector and region, not by country or organization. That caution is consistent with the primary material.

Brazil

Brazil is the only Latin American country named in the main source, but not as a victim of the recent campaign. Symantec and Carbon Black list it alongside the United States, India, Russia, Taiwan and Japan as places where Warlock activity had already been observed. Security Affairs repeats that reading and stresses that the recent victims were described by sector and region, not by country.

That means there is no basis to claim a confirmed Brazilian impact within the analyzed wave. There is, however, a basis to say the country remains part of the actor’s historical observation map and that the recent campaign reached Portuguese- and Spanish-speaking regions, keeping Brazil within the analytical risk area. The source gives no organization names or Brazilian victim count.

United States

The available material does not identify a U.S. victim in the campaign analyzed here. The only concrete reference comes from a secondary source stating that U.S. organizations were among Warlock’s earlier victims, but without providing an organization, state, intrusion date or primary evidence connecting those cases to the July-to-October 2026 operation. For that reason, this report does not treat them as verified parts of the reconstructed campaign.

What is confirmed is that Symantec had already observed prior Warlock activity against organizations in the United States, but that remains a historical antecedent, not identification of a recent victim. The report should be read with that limitation in mind. There is no verifiable basis for country-by-country attribution beyond the aggregated geography already mentioned.

Countries without specific verifiable coverage in the research for this campaign: Argentina, Chile, Paraguay, Bolivia, Peru, Colombia, Mexico and Uruguay.

Technical indicators

The source also publishes hashes tied to Warlock samples, malicious DLLs, suspicious files, an AV and EDR killer and a vulnerable driver. Because they were not fully listed in the consolidated material, this report does not reproduce them to avoid errors.

Analysis for security teams

The immediate priority for defenders is to review on-premises SharePoint environments, especially those that were not patched or mitigated in line with ToolShell. The material describes a chain in which initial entry was not the only problem. Once the machine keys were obtained, the attacker could sign a valid payload, exploit deserialization and operate inside the application pool. That means a standalone web shell does not fully explain the risk; theft of farm secrets changes the severity of the incident.

PowerShell and msiexec telemetry deserves historical review. Base64-encoded commands, loading of System.Workflow.ComponentModel and MSI downloads from catbox.moe and wasabisys.com are actionable signals. If an organization sees msiexec calling unexpected URLs or download domains, or PowerShell loading unusual assemblies in a SharePoint environment, the response should prioritize containment, persistence review and searches for exposed credentials or secrets.

It is also worth looking for abuse of service accounts and changes to local Administrators groups. In the documented intrusion, SPSEPRDSetup was repeatedly added to Administrators on three systems. Combined with NetExec for AD enumeration, password spraying and remote execution, that indicates the actor moved quickly once access was established. Effective control is not limited to blocking a hash. It also means detecting abnormal admin patterns, local group membership changes and remote execution from unusual hosts.

The Visual Studio Code Insiders tunnel as a service is another persistence indicator that deserves specific alerts. code-insiders.exe tunnel service install --accept-server-license-terms is not a command expected in most corporate environments. If it appears in endpoint, EDR or remote administration logs, it should be treated as covert access until proven otherwise. The same logic applies to BYOVD use. A signed driver is not benign by default. K7RKScan appears in the source as abuse of a vulnerable driver to kill security processes at kernel level.

For containment, distribution through SYSVOL requires review of domain controllers, DFSR replication and any logon scripts or Group Policy objects that could inherit malicious binaries. The source also notes that dfsrs.exe appeared as the parent process for delivery on three additional hosts. That suggests detection on a single endpoint is not enough. If SYSVOL was used as a channel, the priority shifts to stopping malicious replication, reviewing replicated content and validating which other workstations may have executed the payload from the domain.

Frequently asked questions

What does this report say about exposure to on-premises SharePoint and Warlock’s regional reach?

The report shows that Warlock, according to the source, used an intrusion in on-premises SharePoint to move through to ransomware deployment, and that the recent impact spread to organizations in Portuguese- and Spanish-speaking countries in Europe, Africa and Latin America. It does not identify a specific Latin American victim, although Brazil appears in the actor’s prior history.

What is the relationship between ToolShell, ASP.NET keys and the final ransomware?

The source links initial access to the ToolShell chain and then describes theft of SharePoint farm ASP.NET machine keys. With those keys, the attackers could forge signed payloads and use deserialization with __VIEWSTATE to execute code. That sequence connects initial access to the stage before Warlock deployment.

Why is the Visual Studio Code Insiders tunnel installation as concerning as the ransomware itself?

Because it was not just another binary, but a service installed with code-insiders.exe tunnel service install --accept-server-license-terms, which Symantec describes as persistence and covert remote access. The combination of that tunnel with NetExec, new admin memberships and SYSVOL suggests sustained domain control before encryption.

Which evasion and propagation techniques made the intrusion harder to stop?

The operation combined a.exe to kill antivirus and EDR processes, abuse of K7RKScan as BYOVD and storage of Warlock in SYSVOL to take advantage of domain replication. That ties endpoint-level evasion to domain controller-level propagation. The Attack chain and TTPs section summarizes that technical sequence.

Which Latin American countries were actually confirmed in the recent campaign?

None were individually confirmed in the recent campaign. The report can only say that the recent victims were aggregated across Portuguese- and Spanish-speaking countries in Europe, Africa and Latin America. Brazil appears in the source as a prior Warlock activity location, not as a named victim in this wave.

Material limitations

The consolidated material does not publish the name or country of any of the four recent organizations, so this report cannot assign a specific victim to Brazil or any other Latin American country. It also does not reproduce the full hashes published by the main source, because the research summarizes them without listing them in full. On the technical side, the source treats the use of on-premises SharePoint exploitation as a probable initial vector, but that probability does not become absolute certainty for every victim. The exact identity of the vulnerable driver used in the detailed intrusion also remains undetermined.