Warlock Ransomware Exploiting Sharepoint Vulnerabilities

Warlock ransomware is exploiting Microsoft SharePoint vulnerabilities to infiltrate enterprise environments. Attackers gain initial access by uploading web shells through targeted HTTP POST requests, then escalate privileges via Group Policy abuse and compromised accounts. They conduct reconnaissance, steal credentials using tools like Mimikatz, and move laterally with Windows administrative shares and remote services. To disable defenses, they deploy custom malware such as KillAV, which terminates security processes, before encrypting files with the .x2anylock extension and exfiltrating sensitive data using RClone disguised as legitimate software. Active since mid-2025, Warlock has impacted organizations worldwide across industries including government, technology, finance, and critical infrastructure.