Warlock Uses SharePoint Web Shells and K7RKScan.sys Driver to Disable EDR Across 40 Hosts in Two Hours
Warlock leveraged SharePoint vulnerabilities for initial access and rapid ransomware deployment in critical infrastructure targets. Evidence shows systematic use of legitimate tools and a known vulnerable driver but lacks independent technical proof of Chinese state direction. Continued exploitation of unpatched servers indicates the threat will persist without broad remediation.
Symantec observed the group push a custom tool that terminated security processes on 40 hosts within two hours before deploying the Warlock binary to 33 machines through domain replication. The initial access chain relied on SharePoint flaws to forge signed payloads and achieve code execution inside the application pool, followed by DLL sideloading and VS Code tunnel abuse for C2.
Technical indicators include reuse of the vulnerable K7RKScan.sys driver (CVE-2025-1055) previously seen with DragonForce ransomware and downloads from catbox.moe and wasabisys.com. Overlaps with CL-CRI-1040 and CamoFei clusters appear in tooling and infrastructure, yet no public packet captures or malware samples independently confirm state attribution beyond Symantec's cluster naming.
The pattern of rapid lateral movement through SYSVOL and BYOVD tactics shows operators prioritizing speed over stealth once inside, consistent with prior Gold Salem activity. Unpatched SharePoint instances remain the persistent weak point rather than novel zero-days.
Organizations should audit on-premises SharePoint deployments immediately and monitor for anomalous driver loads and web shell artifacts in the farm's configuration stores.
Symantec: At least two additional critical infrastructure incidents using the same K7RKScan.sys and SYSVOL staging method will be observed within 60 days if exposed SharePoint servers remain above 300 globally.
Sources (2)
- [1]Symantec Threat Hunter Team Report(https://symantec.com/blogs/threat-intelligence/warlock-sharepoint-2026)
- [2]Broadcom Security Advisory on ToolShell Flaws(https://support.broadcom.com/toolshelle-advisory)