# Warlock (Water Manaul / Storm-2603) Ransomware Campaign with BYOVD, Web Shells, and Multi-Channel Tunneling via SharePoint Exploitation

> The Warlock ransomware group (tracked as Water Manaul by Trend Micro, Storm-2603 by Microsoft) continues an aggressive campaign exploiting unpatched on-premises Microsoft SharePoint servers via the ToolShell vulnerability chain (CVE-2025-53770/CVE-2025-53771) to deploy Cobalt Strike beacons, establish multi-channel C2 infrastructure (Velociraptor, VS Code tunnels, Cloudflare tunnels, Yuze SOCKS5 proxy), perform kernel-level defense evasion via BYOVD using NSecKrnl.sys (CVE-2025-68947), exfiltrate data via Rclone to S3, and deploy GPO-staged ransomware encrypting files with the .LOCKJ extension across enterprise environments.

- **Published:** 2026-03-16T12:00:00Z
- **Last reviewed:** 2026-03-16T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0234
- **ID:** TL-2026-0234
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Warlock (China)
- **Detections:** 9 · **IOCs:** 44 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-53770, CVE-2025-53771, CVE-2025-68947

## Description

Warlock (also known as Water Manaul, Storm-2603, CL-CRI-1040) is a sophisticated ransomware group with assessed ties to Chinese nation-state operations, first emerging publicly in June 2025 on the Russian-language RAMP cybercrime forum. The group operates a Ransomware-as-a-Service (RaaS) model and has deployed multiple ransomware families including their proprietary Warlock/AK47/X2ANYLOCK payload, LockBit 3.0, and Babuk variants.

In this March 2026 campaign documented by Trend Micro, Warlock demonstrates a significantly evolved attack chain targeting enterprise environments across the technology, manufacturing, government, and education sectors in the United States, Germany, Russia, and the United Kingdom.

INITIAL ACCESS: The attack begins with exploitation of unpatched on-premises Microsoft SharePoint servers using the ToolShell vulnerability chain (CVE-2025-53770 for unsafe deserialization leading to RCE, and CVE-2025-53771 for authentication bypass). The w3wp.exe SharePoint worker process spawns a Cobalt Strike beacon delivered via DLL sideloading, where MsMpSrv.exe (originally cookie_exporter.exe) loads MsEdge.dll containing the Cobalt Strike payload. The beacon communicates with the C2 domain code.translatevv.com using jQuery script concealment and encoded cookie-based HTTP traffic.

PERSISTENCE AND WEB SHELLS: The attackers deploy the cproxy.aspx web shell to C:\ProgramData\ for persistent access to the SharePoint server. TightVNC 2.8.85 is installed via PsExec using silent MSI deployment with firewall exception rules for persistent remote desktop access.

MULTI-CHANNEL C2 INFRASTRUCTURE: Warlock establishes five redundant command-and-control channels to ensure persistence even if individual channels are detected and blocked: (1) Cobalt Strike beacon to code.translatevv.com, (2) Velociraptor 0.73.4 deployed via v4.msi from Supabase cloud storage for primary C2 command execution, (3) VS Code CLI insider build tunneling that blends with legitimate developer traffic, (4) Cloudflare Tunnel using both named tunnels (persistent Windows service) and quick tunnels proxying to localhost, and (5) Yuze, a lightweight C-based SOCKS5 reverse proxy connecting to 198.13.158.193 on ports 80, 443, and 53 to probe firewall egress rules.

CREDENTIAL ACCESS: The attackers perform DCSync attacks using debug.exe to impersonate the Domain Controller via the MS-DRSR protocol, access the Windows Credential Manager via rundll32.exe keymgr.dll,KRShowKeyMgr, and dump registry hives. Domain Administrator credentials are compromised, the Administrator password is reset, and the Desktop Admins group is added to the local Administrators group.

LATERAL MOVEMENT: PsExec is used for remote command execution and tool deployment across the domain. PSRemoting is enabled with Enable-PSRemoting -Force -SkipNetworkProfileCheck. An RDP patcher is deployed to enable concurrent multi-session RDP access.

DEFENSE EVASION - BYOVD: The attackers deploy NSecKrnl.sys, a vulnerable kernel driver from NSecSoft (CVE-2025-68947, CWE-862 Missing Authorization), using the Bring Your Own Vulnerable Driver technique. The driver is loaded as a filesystem service via sc create NSecKrnl. The loader TrendSecurity.exe (renamed from a custom NSec-Killer variant) leverages the vulnerable driver to continuously terminate 30+ security product processes at the kernel level, including 13 Trend Micro processes, 7 CrowdStrike processes, 4 Microsoft Defender processes, and 2 Symantec processes. Additional defense evasion includes DLL sideloading, fileless execution via PowerShell Assembly.Load() and EntryPoint.Invoke(), tool renaming (Rclone disguised as TrendSecurity.exe and TrendFileSecurityCheck.exe), and abuse of legitimate cloud infrastructure.

DATA EXFILTRATION: Rclone (disguised as TrendFileSecurityCheck.exe) copies targeted file types (PDF, AI, DWG, DXF, DOC, DOCX, XLSX, CSV, PPT, PPTX, and CAD formats) to an attacker-controlled S3 bucket using 11 parallel transfer streams with a 500-day lookback window and 2GB maximum file size.

RANSOMWARE DEPLOYMENT: The ransomware payload (run.dll exporting RunCryptor, and run.exe) is staged in SYSVOL and NETLOGON shares and deployed enterprise-wide via Group Policy Objects. A startup script CentralStartup.cmd copies the payload and the BYOVD loader from SYSVOL to C:\users\public\ and executes both. Files are encrypted with the .LOCKJ extension and the lockdatareadme.txt ransom note is dropped. The dwell time between initial compromise and ransomware execution is approximately 15 days, with attackers timing activity to coincide with holiday periods and reduced monitoring.

This campaign represents a significant evolution from Warlock's earlier operations which used the .x2anylock extension and a vulnerable Baidu antivirus driver (googleApiUtil64.sys) for BYOVD. The shift to NSecKrnl.sys and the .LOCKJ extension, combined with the multi-channel tunneling infrastructure, demonstrates continuous operational refinement.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1218 System Binary Proxy Execution
- T1569 System Services
- T1505 Server Software Component
- T1543 Create or Modify System Process
- T1068 Exploitation for Privilege Escalation
- T1484 Domain or Tenant Policy Modification
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1620 Reflective Code Loading
- T1036 Masquerading
- T1574 Hijack Execution Flow
- T1003 OS Credential Dumping
- T1555 Credentials from Password Stores
- T1087 Account Discovery
- T1021 Remote Services
- T1560 Archive Collected Data
- T1095 Non-Application Layer Protocol
- T1572 Protocol Tunneling
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol
- T1048 Exfiltration Over Alternative Protocol
- T1486 Data Encrypted for Impact

## Sources

- [Trend Micro: Web Shells, Tunnels, and Ransomware - Dissecting a Warlock Attack](https://www.trendmicro.com/en_us/research/26/c/dissecting-a-warlock-attack.html)
- [Trend Micro: Warlock - From SharePoint Vulnerability Exploit to Enterprise Ransomware](https://www.trendmicro.com/en_us/research/25/h/warlock-ransomware.html)
- [Halcyon: Threat Intel Report - Warlock Professional Development, China Ties, and Multiple Variants](https://www.halcyon.ai/ransomware-research-reports/threat-intel-report-warlock)
- [Security.com: Warlock Ransomware - Old Actor, New Tricks?](https://www.security.com/threat-intelligence/warlock-ransomware-origins)
- [CISA: Known Exploited Vulnerability CVE-2025-53770 ToolShell Added to Catalog](https://www.cisa.gov/news-events/alerts/2025/07/20/cisa-adds-one-known-exploited-vulnerability-cve-2025-53770-toolshell-catalog)
- [Unit 42: Active Exploitation of Microsoft SharePoint Vulnerabilities](https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/)
- [ThreatLocker: Warlock Ransomware Group Targets Global Industries via RaaS Affiliates](https://www.threatlocker.com/blog/warlock-ransomware-group-targets-global-industries-via-raas-affiliates)
- [Ransomware.live: Warlock Group Tracker](https://www.ransomware.live/group/warlock)
- [CyberPress: New Investigation Uncovers Sophisticated Warlock Ransomware Campaign](https://cyberpress.org/warlock-ransomware-campaign/)
- [Gurucul: Reynolds Ransomware BYOVD CVE-2025-68947 Analysis (NSecKrnl.sys shared TTP)](https://gurucul.com/blog/reynolds-ransomware-byovd-abuse-of-nseckrnl-sys-cve-2025-68947-for-kernel-level-defense-evasion/)
- [Akamai: SharePoint RCE Exploitations, Detections, and Mitigations](https://www.akamai.com/blog/security-research/sharepoint-vulnerability-rce-active-exploitation-detections-mitigations)
- [Wiz: SharePoint Vulnerabilities CVE-2025-53770 and CVE-2025-53771 - Everything You Need to Know](https://www.wiz.io/blog/sharepoint-vulnerabilities-cve-2025-53770-cve-2025-53771-everything-you-need-to-k)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0234