Warlock Ransomware Exploits SharePoint Vulnerabilities in Massive Global Attack Campaign

Nation-state exploitation and ransomware crime running on the same SharePoint flaws.

Warlock is ransomware delivered through ToolShell, an exploit chain that pairs a spoofing flaw (CVE-2025-53771) with a critical remote-code-execution flaw (CVE-2025-53770, CVSS 9.8) in on-premises SharePoint.

What makes this campaign stand out is its reach and its origin story. The two vulnerabilities are variants of earlier flaws - CVE-2025-49704 and CVE-2025-49706 - that Microsoft had already patched. Storm-2603 found a way to bypass those original fixes, turning a "we already patched that" server back into an open door. The exploit sidesteps multi-factor authentication and single sign-on, gives full access to SharePoint content, and runs code over the network with no user interaction at all.

The blast radius is wide because SharePoint rarely sits alone. It is wired into the rest of Microsoft's ecosystem, so a compromised server can open paths into Office, Teams, OneDrive, and Outlook. Victims span 21 countries, and the United States accounts for over 13% of all attacks, making it the most heavily targeted nation.

Authentication bypass, then remote code execution, then persistence that survives a reboot.

Attackers hit a specific SharePoint endpoint with a spoofed request, run code through unsafe deserialization, then plant a web shell and steal the server's cryptographic keys to keep access.

• Spoof the request. Attackers send crafted POST requests to SharePoint's /_layouts/15/ToolPane.aspx endpoint with a spoofed Referer header set to SignOut.aspx, using CVE-2025-53771 to slip past authentication.
• Run code. CVE-2025-53770 is triggered through unsafe deserialization of untrusted data, so malicious serialized input gets processed and executed on the server.
• Plant a web shell. A spinstall0.aspx web shell is dropped for persistent backdoor access, and legitimate processes like cmd.exe and w3wp.exe are used for quiet reconnaissance.
• Steal the keys. Attackers lift the ASP.NET ValidationKey and DecryptionKey, which lets them forge authentication tokens and malicious __VIEWSTATE payloads - so access survives a reboot or web-shell cleanup.
• Spread the ransomware. Mimikatz pulls credentials from LSASS memory, PsExec moves laterally, and modified Group Policy Objects push Warlock ransomware across the network.

That key-theft step is why this is so hard to shake. Rebooting the server or deleting the web shell does not help if the attacker already holds your machine keys - which is exactly why key rotation is a required part of the fix, not an optional one.

Three Chinese groups - one criminal, two state-sponsored - on the same flaws.

Microsoft attributes the Warlock ransomware to Storm-2603, a suspected China-based group, while two confirmed Chinese state-sponsored actors exploit the same SharePoint flaws for espionage.

• Storm-2603. The primary actor deploying Warlock ransomware since July 18, 2025. It has previously deployed both Warlock and LockBit; Microsoft cannot confidently assess its exact objectives or sponsorship.
• Linen Typhoon (APT27). A confirmed Chinese state-sponsored group focused on intellectual-property theft, with over a decade of documented activity against Western organizations.
• Violet Typhoon (APT31). A state-sponsored espionage group running intelligence operations, also exploiting the same SharePoint vulnerabilities.

When both criminal and nation-state groups pile onto the same bug within days, it tells you the exploit is reliable and valuable - and that internet-facing SharePoint is being scanned constantly, not occasionally.

Only on-premises SharePoint is affected - but exposure is broad.

You are at risk if you run on-premises SharePoint Server 2016, 2019, or Subscription Edition; Microsoft 365 SharePoint Online is not affected by these vulnerabilities.

The Shadowserver Foundation counted nearly 11,000 SharePoint instances still exposed to the internet as of July 24, 2025 - a large pool of potential victims. Because exploitation is remote and needs no authentication, attackers are not filtering by company size. Plenty of Houston law firms, engineering shops, and energy-services companies still run an on-prem SharePoint box for document management, and a delayed patch cycle is exactly the gap this campaign was built to exploit. Highest-risk targets include:

• Any internet-facing on-prem SharePoint server. Remote, unauthenticated exploitation means exposure alone is enough.
• Government, energy, and critical-infrastructure operators. Confirmed victims include multiple U.S. federal agencies and grid operators.
• Healthcare, education, professional services, manufacturing, and financial firms. All appear among the targeted sectors.
• Smaller businesses with lean IT. Limited resources and slower patch deployment make on-prem SharePoint a soft target.

Patching alone is not enough - you have to rotate keys and hunt for a foothold.

Microsoft has released updates that fully fix CVE-2025-53770 and CVE-2025-53771, but because attackers steal machine keys, remediation also requires rotating those keys and assuming compromise.

• Patch immediately. Apply the July 2025 security updates for SharePoint Server Subscription Edition, 2019, and 2016, then restart IIS with iisreset.exe on every SharePoint server.
• Rotate the machine keys - twice. Rotate ASP.NET machine keys before applying patches and again after, and monitor for unauthorized access to key storage locations.
• Turn on AMSI and Defender. Enable Antimalware Scan Interface in Full Mode, deploy Microsoft Defender Antivirus on all SharePoint servers, and enable HTTP request-body scanning where available.
• Segment and disconnect. Take any end-of-life, public-facing SharePoint server off the internet and segment the network to limit lateral movement.
• Hunt for the foothold. Search for spinstall0.aspx and info3.aspx in the SharePoint layouts directories, watch for w3wp.exe spawning encoded PowerShell, and check for suspicious POSTs to ToolPane.aspx. Treat any internet-facing server from the past month as already compromised.