Warlock (Water Manaul / Storm-2603) Ransomware Campaign with BYOVD, Web Shells, and Multi-Channel Tunneling via SharePoint Exploitation — Threadlinqs Intelligence
As of 2026-05-30, Warlock (Water Manaul / Storm-2603) Ransomware Campaign with BYOVD, Web Shells, and Multi-Channel Tunneling via SharePoint Exploitation is a critical-severity ransomware threat attributed to Warlock (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 44 indicators of compromise.
Threat ID: TL-2026-0234 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: RANSOMWARE
Attribution: Warlock · China · FINANCIAL
The Warlock ransomware group (tracked as Water Manaul by Trend Micro, Storm-2603 by Microsoft) continues an aggressive campaign exploiting unpatched on-premises Microsoft SharePoint servers via the
Warlock (also known as Water Manaul, Storm-2603, CL-CRI-1040) is a sophisticated ransomware group with assessed ties to Chinese nation-state operations, first emerging publicly in June 2025 on the Russian-language RAMP cybercrime forum. The group operates a Ransomware-as-a-Service (RaaS) model and has deployed multiple ransomware families including their proprietary Warlock/AK47/X2ANYLOCK payload, LockBit 3.0, and Babuk variants.
In this March 2026 campaign documented by Trend Micro, Warlock demonstrates a significantly evolved attack chain targeting enterprise environments across the technology, manufacturing, government, and education sectors in the United States, Germany, Russia, and the United Kingdom.
INITIAL ACCESS: The attack begins with exploitation of unpatched on-premises Microsoft SharePoint servers using the ToolShell vulnerability chain (CVE-2025-53770 for unsafe deserialization leading to RCE, and CVE-2025-53771 for authentication bypass). The w3wp.exe SharePoint worker process spawns a Cobalt Strike beacon delivered via DLL sideloading, where MsMpSrv.exe (originally cookie_exporter.exe) loads MsEdge.dll containing the Cobalt Strike payload. The beacon communicates with the C2 domain code.translatevv.com using jQuery script concealment and encoded cookie-based HTTP traffic.
PERSISTENCE AND WEB SHELLS: The attackers deploy the cproxy.aspx web shell to C:\ProgramData\ for persistent access to the SharePoint server. TightVNC 2.8.85 is installed via PsExec using silent MSI deployment with firewall exception rules for persistent remote desktop access.
MULTI-CHANNEL C2 INFRASTRUCTURE: Warlock establishes five redundant command-and-control channels to ensure persistence even if individual channels are detected and blocked: (1) Cobalt Strike beacon to code.translatevv.com, (2) Velociraptor 0.73.4 deployed via v4.msi from Supabase cloud storage for primary C2 command execution, (3) VS Code CLI insider build tunneling that blends with legitimate developer traffic, (4) Cloudflare Tunnel using both named tunnels (persistent Windows service) and quick tunnels proxying to localhost, and (5) Yuze, a lightweight C-based SOCKS5 reverse proxy connecting to 198.13.158.193 on ports 80, 443, and 53 to probe firewall egress rules.
CREDENTIAL ACCESS: The attackers perform DCSync attacks using debug.exe to impersonate the Domain Controller via the MS-DRSR protocol, access the Windows Credential Manager via rundll32.exe keymgr.dll,KRShowKeyMgr, and dump registry hives. Domain Administrator credentials are compromised, the Administrator password is reset, and the Desktop Admins group is added to the local Administrators group.
LATERAL MOVEMENT: PsExec is used for remote command execution and tool deployment across the domain. PSRemoting is enabled with Enable-PSRemoting -Force -SkipNetworkProfileCheck. An RDP patcher is deployed to enable concurrent multi-session RDP access.
DEFENSE EVASION - BYOVD: The attackers deploy NSecKrnl.sys, a vulnerable kernel driver from NSecSoft (CVE-2025-68947, CWE-862 Missing Authorization), using the Bring Your Own Vulnerable Driver technique. The driver is loaded as a filesystem service via sc create NSecKrnl. The loader TrendSecurity.exe (renamed from a custom NSec-Killer variant) leverages the vulnerable driver to continuously terminate 30+ security product processes at the kernel level, including 13 Trend Micro processes, 7 CrowdStrike processes, 4 Microsoft Defender processes, and 2 Symantec processes. Additional defense evasion includes DLL sideloading, fileless execution via PowerShell Assembly.Load() and EntryPoint.Invoke(), tool renaming (Rclone disguised as TrendSecurity.exe and TrendFileSecurityCheck.exe), and abuse of legitimate cloud infrastructure.
DATA EXFILTRATION: Rclone (disguised as TrendFileSecurityCheck.exe) copies targeted file types (PDF, AI, DWG, DXF, DOC, DOCX, XLSX, CSV, PPT, PPTX, and CAD formats) to an attacker-controlled S3 bucket using 11 parallel transfer streams with
Weaknesses (CWE)
CWE-502, CWE-862, CWE-287
Target sectors: technology, manufacturing, government, education, finance, healthcare, energy, telecom
Target regions: United States, Germany, Russia, United Kingdom, Middle East, Asia
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 44 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
RANSOMWARE, CRITICAL, threat intelligence, cybersecurity, CVE-2025-53770, CVE-2025-53771, CVE-2025-68947, T1190, T1059, T1218, T1569, T1505, T1543, T1068, T1484, T1562, T1027