Warlock Ransomware Exploits Unpatched SharePoint and ToolShell Flaws Globally

Key points

• Warlock ransomware is exploiting unpatched flaws in SharePoint and ToolShell.
• Targets include water utilities, telecoms, governments, universities, and other critical infrastructure.
• Activity spans mid-2025 and was still being tracked about a year later.
• Symantec and Microsoft reported the campaign; no CVE identifiers were provided.
• Severity is assessed as medium.

Security researchers at Symantec and Microsoft have linked a global extortion campaign to the Warlock ransomware operation. The group is said to take advantage of unpatched vulnerabilities in SharePoint and a tool called ToolShell to gain entry, then compromise organizations and deploy ransomware. No CVE identifiers were included in the available reporting, which limits straightforward patch mapping.

Victims span multiple sectors and regions. Essential services are in scope, including drinking-water utilities, telecommunications providers, government agencies, and universities. Because these organizations often run large collaboration and web-facing environments, an unpatched SharePoint or ToolShell exposure can become a foothold for broader network access.

The campaign matters because it combines known gaps with ransomware, a combination that can disrupt public services and cause costly downtime. Critical infrastructure operators may face operational outages, data theft, and recovery pressure. The global reach means no region is inherently safe if exposed systems remain unpatched.

The activity dates to mid-2025, and reporting indicates it was still relevant roughly a year later. That persistence suggests either continued exploitation of the same weaknesses or repeated targeting of organizations that have not completed remediation. Symantec and Microsoft are the named vendors providing visibility into the threat.

Administrators should watch for exploitation attempts against SharePoint and ToolShell, unusual authentication activity, and ransomware precursors such as credential dumping or lateral movement. Since no CVE numbers were cited, teams should rely on vendor guidance and threat intelligence rather than a single patch identifier. Severity is currently assessed as medium.

What to do now

1. Inventory internet-facing SharePoint and any ToolShell deployments; confirm supported versions and patch levels immediately.
2. Apply all available vendor security updates from Microsoft and other relevant suppliers; if no CVE is available, follow vendor advisories and compensating controls.
3. Restrict remote access to SharePoint and ToolShell management interfaces using VPN, zero-trust rules, or IP allowlists.
4. Enable and centralize logging for authentication, web requests, and endpoint process creation; alert on suspicious access and ransomware behavior.
5. Segment critical infrastructure networks and enforce least privilege to limit lateral movement from a compromised collaboration service.
6. Verify offline, immutable backups for water utilities, telecoms, government, and university systems; test restoration.
7. Brief users on phishing and credential hygiene, and enforce MFA on all administrative and remote-access accounts.

Original source

Security Affairs