Warlock (Water Manaul / Storm-2603) Ransomware Campaign with BYOVD, Web Shells, and Multi-Channel Tunneling via SharePoint Exploitation

Warlock (Water Manaul / Storm-2603) Ransomware Campaign with (TL-2026-0234), also tracked as Water Manaul Campaign, is a critical-severity ransomware operation scored CVSS 9.8, first published 2026-03-16. It is attributed to Warlock (China) with high confidence, affects Microsoft SharePoint Server, references 3 CVEs (CVE-2025-53770, CVE-2025-53771, CVE-2025-68947), maps to 24 MITRE ATT&CK techniques (T1003, T1021, T1027), and is covered by 9 detection rules and 44 indicators of compromise.

Key facts for TL-2026-0234

Threat ID
TL-2026-0234
Also known as
Water Manaul Campaign, Operation Warlock, ToolShell Ransomware Campaign
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
RANSOMWARE
First published
2026-03-16
Last reviewed
2026-03-16
Attribution
Warlock
Attribution confidence
HIGH
Nation-state nexus
China
Motivation
FINANCIAL
Target sectors
technology, manufacturing, government, education, finance, healthcare, energy, telecom
Target regions
United States, Germany, Russia, United Kingdom, Middle East, Asia
Detection rules
9
Indicators of compromise
44

Malware and tooling in Warlock (Water Manaul / Storm-2603) Ransomware Campaign with

Malware and tooling: WarLock, X2ANYLOCK, AK47C2, Cobalt Strike, NSec-Killer, Rclone - S1040, Velociraptor 0.73.4, Yuze SOCKS5 Proxy

The Warlock ransomware group (tracked as Water Manaul by Trend Micro, Storm-2603 by Microsoft) continues an aggressive campaign exploiting unpatched on-premises Microsoft SharePoint servers via the ToolShell vulnerability chain (CVE-2025-53770/CVE-2025-53771) to deploy Cobalt Strike beacons, establish multi-channel C2 infrastructure (Velociraptor, VS Code tunnels, Cloudflare tunnels, Yuze SOCKS5 proxy), perform kernel-level defense evasion via BYOVD using NSecKrnl.sys (CVE-2025-68947), exfiltrate data via Rclone to S3, and deploy GPO-staged ransomware encrypting files with the .LOCKJ extension across enterprise environments.

How Warlock (Water Manaul / Storm-2603) Ransomware Campaign with works

Warlock (also known as Water Manaul, Storm-2603, CL-CRI-1040) is a sophisticated ransomware group with assessed ties to Chinese nation-state operations, first emerging publicly in June 2025 on the Russian-language RAMP cybercrime forum. The group operates a Ransomware-as-a-Service (RaaS) model and has deployed multiple ransomware families including their proprietary Warlock/AK47/X2ANYLOCK payload, LockBit 3.0, and Babuk variants.

In this March 2026 campaign documented by Trend Micro, Warlock demonstrates a significantly evolved attack chain targeting enterprise environments across the technology, manufacturing, government, and education sectors in the United States, Germany, Russia, and the United Kingdom.

INITIAL ACCESS: The attack begins with exploitation of unpatched on-premises Microsoft SharePoint servers using the ToolShell vulnerability chain (CVE-2025-53770 for unsafe deserialization leading to RCE, and CVE-2025-53771 for authentication bypass). The w3wp.exe SharePoint worker process spawns a Cobalt Strike beacon delivered via DLL sideloading, where MsMpSrv.exe (originally cookie_exporter.exe) loads MsEdge.dll containing the Cobalt Strike payload. The beacon communicates with the C2 domain code.translatevv.com using jQuery script concealment and encoded cookie-based HTTP traffic.

PERSISTENCE AND WEB SHELLS: The attackers deploy the cproxy.aspx web shell to C:\ProgramData\ for persistent access to the SharePoint server. TightVNC 2.8.85 is installed via PsExec using silent MSI deployment with firewall exception rules for persistent remote desktop access.

MULTI-CHANNEL C2 INFRASTRUCTURE: Warlock establishes five redundant command-and-control channels to ensure persistence even if individual channels are detected and blocked: (1) Cobalt Strike beacon to code.translatevv.com, (2) Velociraptor 0.73.4 deployed via v4.msi from Supabase cloud storage for primary C2 command execution, (3) VS Code CLI insider build tunneling that blends with legitimate developer traffic, (4) Cloudflare Tunnel using both named tunnels (persistent Windows service) and quick tunnels proxying to localhost, and (5) Yuze, a lightweight C-based SOCKS5 reverse proxy connecting to 198.13.158.193 on ports 80, 443, and 53 to probe firewall egress rules.

CREDENTIAL ACCESS: The attackers perform DCSync attacks using debug.exe to impersonate the Domain Controller via the MS-DRSR protocol, access the Windows Credential Manager via rundll32.exe keymgr.dll,KRShowKeyMgr, and dump registry hives. Domain Administrator credentials are compromised, the Administrator password is reset, and the Desktop Admins group is added to the local Administrators group.

LATERAL MOVEMENT: PsExec is used for remote command execution and tool deployment across the domain. PSRemoting is enabled with Enable-PSRemoting -Force -SkipNetworkProfileCheck. An RDP patcher is deployed to enable concurrent multi-session RDP access.

DEFENSE EVASION - BYOVD: The attackers deploy NSecKrnl.sys, a vulnerable kernel driver from NSecSoft (CVE-2025-68947, CWE-862 Missing Authorization), using the Bring Your Own Vulnerable Driver technique. The driver is loaded as a filesystem service via sc create NSecKrnl. The loader TrendSecurity.exe (renamed from a custom NSec-Killer variant) leverages the vulnerable driver to continuously terminate 30+ security product processes at the kernel level, including 13 Trend Micro processes, 7 CrowdStrike processes, 4 Microsoft Defender processes, and 2 Symantec processes. Additional defense evasion includes DLL sideloading, fileless execution via PowerShell Assembly.Load() and EntryPoint.Invoke(), tool renaming (Rclone disguised as TrendSecurity.exe and TrendFileSecurityCheck.exe), and abuse of legitimate cloud infrastructure.

DATA EXFILTRATION: Rclone (disguised as TrendFileSecurityCheck.exe) copies targeted file types (PDF, AI, DWG, DXF, DOC, DOCX, XLSX, CSV, PPT, PPTX, and CAD formats) to an attacker-controlled S3 bucket using 11 parallel transfer streams with a 500-day lookback window and 2GB maximum file size.

RANSOMWARE DEPLOYMENT: The ransomware payload (run.dll exporting RunCryptor, and run.exe) is staged in SYSVOL and NETLOGON shares and deployed enterprise-wide via Group Policy Objects. A startup script CentralStartup.cmd copies the payload and the BYOVD loader from SYSVOL to C:\users\public\ and executes both. Files are encrypted with the .LOCKJ extension and the lockdatareadme.txt ransom note is dropped. The dwell time between initial compromise and ransomware execution is approximately 15 days, with attackers timing activity to coincide with holiday periods and reduced monitoring.

This campaign represents a significant evolution from Warlock's earlier operations which used the .x2anylock extension and a vulnerable Baidu antivirus driver (googleApiUtil64.sys) for BYOVD. The shift to NSecKrnl.sys and the .LOCKJ extension, combined with the multi-channel tunneling infrastructure, demonstrates continuous operational refinement.

MITRE ATT&CK techniques used in TL-2026-0234

credential-access

T1003 OS Credential Dumping; T1555 Credentials from Password Stores

lateral-movement

T1021 Remote Services

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1484 Domain or Tenant Policy Modification; T1620 Reflective Code Loading

exfiltration

T1048 Exfiltration Over Alternative Protocol

execution

T1059 Command and Scripting Interpreter; T1569 System Services

privilege-escalation

T1068 Exploitation for Privilege Escalation

command-and-control

T1071 Application Layer Protocol; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling

discovery

T1087 Account Discovery

initial-access

T1190 Exploit Public-Facing Application

stealth

T1218 System Binary Proxy Execution

impact

T1486 Data Encrypted for Impact

persistence

T1505 Server Software Component; T1543 Create or Modify System Process; T1574 Hijack Execution Flow

collection

T1560 Archive Collected Data

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in Warlock (Water Manaul / Storm-2603) Ransomware Campaign with

  • Microsoft — SharePoint Server
    Vulnerable versions: 2016; 2019; Subscription Edition (unpatched)
    Fixed in: 2016 with July 2025 Security Update; 2019 with July 2025 Security Update; Subscription Edition with July 2025 Security Update
  • NSecSoft — NSecKrnl.sys Kernel Driver
    Vulnerable versions: All versions with CVE-2025-68947
  • Trend Micro — Multiple Endpoint Security Products
    Vulnerable versions: Products without kernel-level tamper protection
    Fixed in: Products with Agent Self-Protection enabled
  • CrowdStrike — Falcon Endpoint Protection
    Vulnerable versions: Versions susceptible to kernel-level process termination
  • Microsoft — Windows Defender
    Vulnerable versions: MsMpEng.exe susceptible to BYOVD termination
  • Symantec — Endpoint Protection
    Vulnerable versions: Versions susceptible to kernel-level process termination

Remediation for Warlock (Water Manaul / Storm-2603) Ransomware Campaign with

Patches

  • Microsoft SharePoint Security Update for CVE-2025-53770 (ToolShell RCE) - apply to SharePoint Server 2016, 2019, and Subscription Edition
  • Microsoft SharePoint Security Update for CVE-2025-53771 (ToolShell Auth Bypass)
  • Block NSecKrnl.sys driver hash via WDAC recommended blocklist for CVE-2025-68947

Immediate actions

  • Patch all on-premises Microsoft SharePoint servers against CVE-2025-53770 and CVE-2025-53771 immediately
  • Block C2 domain code.translatevv.com and IP 198.13.158.193 at perimeter firewalls and DNS sinkholes
  • Block domains vdfccjpnedujhrzscjtq.supabase.co, litter.catbox.moe, files.catbox.moe at web proxies
  • Hunt for cproxy.aspx web shells on SharePoint servers in C:\ProgramData\ and IIS content directories
  • Search for NSecKrnl.sys driver loading events and sc create NSecKrnl service creation
  • Monitor for TrendSecurity.exe and TrendFileSecurityCheck.exe processes that are not legitimate Trend Micro binaries
  • Check GPO startup scripts for suspicious entries referencing run.dll, run.exe, or RunCryptor
  • Audit SYSVOL and NETLOGON shares for unauthorized DLL and EXE files

Workarounds

  • If patching is not immediately possible, restrict external access to SharePoint /_layouts/15/ToolPane.aspx endpoint
  • Disable the Guest account on all domain controllers and member servers
  • Restrict PowerShell remoting to authorized administrative workstations only
  • Monitor and alert on sc create commands that load .sys files from user-writable directories

Longer-term hardening

  • Deploy Windows Defender Application Control (WDAC) or equivalent driver blocklist policies to prevent loading of NSecKrnl.sys and other known vulnerable drivers
  • Implement network segmentation to limit lateral movement from SharePoint DMZ to internal domain controllers
  • Deploy EDR with kernel-level tamper protection and behavioral detection for BYOVD attacks
  • Enable AMSI integration with antivirus on all SharePoint servers
  • Rotate all SharePoint machine keys (ValidationKey, DecryptionKey) after patching
  • Implement strict GPO change monitoring and alerting
  • Deploy egress filtering to detect and block unauthorized Cloudflare tunnels, VS Code tunnels, and SOCKS5 proxy traffic
  • Monitor for Rclone network patterns and S3 data exfiltration

CVEs associated with Warlock (Water Manaul / Storm-2603) Ransomware Campaign with

CVE-2025-53770, CVE-2025-53771, CVE-2025-68947

Weaknesses (CWE) in Warlock (Water Manaul / Storm-2603) Ransomware Campaign with

CWE-502, CWE-862, CWE-287

Timeline of Warlock (Water Manaul / Storm-2603) Ransomware Campaign with

  • Warlock group establishes infrastructure and initiates AK47 C2 framework development with organized project structure
  • First Warlock ransomware prototype (writenull) created; experimental encryption variants follow within days
  • Warlock publicly launches on Russian-language RAMP cybercrime forum as RaaS operator; claims 16+ victims within days
  • CVE-2025-53770 (ToolShell) SharePoint zero-day exploitation begins; Warlock among first groups to weaponize alongside Chinese nation-state actors
  • CISA adds CVE-2025-53770 ToolShell to Known Exploited Vulnerabilities catalog
  • Trend Micro publishes initial Warlock analysis documenting SharePoint exploitation with .x2anylock extension and Baidu driver BYOVD
  • EndProcess.exe dropped to C:\Temp\; cproxy.aspx web shell deployed to C:\ProgramData\ for persistent SharePoint access
  • Warlock attackers exploit unpatched SharePoint server during holiday period with reduced monitoring; w3wp.exe spawns Cobalt Strike beacon via DLL sideloading
  • NSecKrnl.sys vulnerable driver loaded via sc create; TrendSecurity.exe begins kernel-level termination of 30+ security product processes across Trend Micro, CrowdStrike, Defender, and Symantec
  • DCSync attack via debug.exe; credential harvesting from Windows Credential Manager; domain administrator compromise; lateral movement via PsExec, PSRemoting, and RDP
  • Velociraptor v0.73.4 deployed via v4.msi from Supabase; VS Code CLI tunnel and Cloudflare tunnel established as redundant C2 channels
  • Rclone (disguised as TrendFileSecurityCheck.exe) exfiltrates targeted file types (PDF, CAD, Office documents) to attacker S3 bucket with 11 parallel streams
  • Ransomware payload (run.dll RunCryptor) staged in SYSVOL/NETLOGON and deployed enterprise-wide via GPO startup scripts; files encrypted with .LOCKJ extension; lockdatareadme.txt ransom note dropped
  • Trend Micro publishes detailed analysis of evolved Warlock attack chain with multi-channel tunneling, NSecKrnl.sys BYOVD, and GPO-staged .LOCKJ ransomware
  • As of 2026-05-29, this Warlock/Storm-2603 (GOLD SALEM) SharePoint-ToolShell ransomware threat remains ACTIVE: the actor is undisrupted with no takedown reported, and exploitation of unpatched on-prem servers continues into 2026. Though CVE-2025-53770 is in CISA KEV and Microsoft-patched (Jul 2025), un-remediated estates keep it live; CVE-2025-68947 BYOVD persists.

Sources cited for Warlock (Water Manaul / Storm-2603) Ransomware Campaign with

Threats related to Warlock (Water Manaul / Storm-2603) Ransomware Campaign with

Detection coverage for TL-2026-0234

As of 2026-03-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0234 across Splunk SPL, Microsoft KQL and Sigma, covering 44 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats