When the Sensor Goes Dark: Warlock Ransomware and the Kill-Before-Encrypt Playbook
Executive Summary
Between July and October 2025, the China-linked threat actor Storm-2603 deployed Warlock ransomware against at least four organizations—including a water utility, a telecom provider, a regional government body, and a university—across Portuguese- and Spanish-speaking countries in Europe, Africa, and Latin America. The attackers exploited unpatched on-premises Microsoft SharePoint vulnerabilities, including flaws disclosed and patched in July 2025, to plant web shells and spend nine days establishing persistence, mapping the domain, creating rogue service accounts, and staging lateral movement. In the final phase, a purpose-built tool disabled endpoint security software across roughly 40 hosts within two hours, after which Warlock ransomware was deployed via SYSVOL replication to at least 33 domain-joined hosts.
This incident exposes a systemic assumption embedded in most security budgets: that detection and response tools will be operational when an attack arrives. Storm-2603's deliberate kill-before-encrypt playbook invalidates that assumption, demanding a shift toward network-layer and memory-resident controls that act before an adversary accumulates the privileges needed to silence sensors.
Why This Matters Now
With 81% of U.S. community water systems classified as small and understaffed, and Storm-2603's Warlock playbook requiring no geographic boundaries, the window between sensor-kill and encryption is measured in minutes. Critical infrastructure operators globally face regulatory pressure under CISA directives and NIS2 while relying on endpoint tools that an attacker with nine days of dwell time can disable at will—making network-enforced zero trust controls an immediate operational necessity.
Attack Path Analysis
Storm-2603 exploited unpatched on-premises Microsoft SharePoint vulnerabilities (ToolShell and related CVEs) to deploy a web shell, then spent nine days escalating privileges, adding rogue service accounts to local administrator groups, and mapping the domain before disabling endpoint security tools across 40+ hosts in under two hours. The attackers staged Warlock ransomware in SYSVOL for domain-wide replication, achieving near-simultaneous encryption across at least 33 hosts after neutralizing the sensors that would have detected them — demonstrating that controls dependent on sensor availability failed catastrophically once the kill step executed.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers exploited known Microsoft SharePoint vulnerabilities (ToolShell flaws disclosed and patched July 2025, plus older unpatched CVEs) on internet-facing on-premises SharePoint servers to deploy a web shell, establishing a persistent foothold without valid credentials. The prolonged presence of unpatched servers across critical infrastructure sectors enabled exploitation of bugs with available patches, confirming a failure of timely remediation.
Related CVEs
CVE-2025-53770
CVSS 9.8A remote code execution vulnerability in Microsoft SharePoint Server (ToolShell) allows unauthenticated attackers to execute arbitrary code via crafted HTTP requests. This flaw was actively exploited by Storm-2603 in July 2025 as an initial access vector.
Affected Products:
Microsoft SharePoint Server – SharePoint Server 2019, SharePoint Server Subscription Edition, SharePoint Server 2016
Exploit Status:
exploited in the wildCVE-2025-53771
CVSS 6.5A server-side request forgery (SSRF) vulnerability in Microsoft SharePoint Server (ToolShell chain) enables attackers to chain with remote code execution flaws for full server compromise. Exploited in the wild by Storm-2603 alongside CVE-2025-53770 in July 2025.
Affected Products:
Microsoft SharePoint Server – SharePoint Server 2019, SharePoint Server Subscription Edition, SharePoint Server 2016
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Server Software Component: Web Shell
Valid Accounts
Impair Defenses: Disable or Modify Tools
Software Deployment Tools
System Services: Service Execution
Data Encrypted for Impact
Masquerading
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Flaw Remediation
Control ID: SI-2
NIS2 Directive (EU) 2022/0383 – Security in Network and Information Systems Acquisition, Development and Maintenance
Control ID: Article 21(2)(e)
CISA Zero Trust Maturity Model 2.0 – Endpoint Telemetry Continuity and Tamper Resistance
Control ID: Device Pillar — Visibility and Analytics
DORA (EU Regulation 2022/2554) – ICT Asset Protection and Resilience Controls
Control ID: Article 9 — ICT Security Policies and Procedures
PCI DSS 4.0 – Timely Patching of Software and System Components
Control ID: Requirement 6.3.3
NYDFS 23 NYCRR 500 – Monitoring and Alerting of Cybersecurity Events
Control ID: Section 500.14(b)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Utilities
Warlock ransomware directly targeted a water utility, exploiting SharePoint flaws and disabling endpoint sensors across 40 hosts in two hours, exposing critical infrastructure to catastrophic operational disruption.
Telecommunications
A telecom provider was confirmed among Storm-2603 victims, facing ransomware-driven lateral movement and exfiltration risks requiring zero trust segmentation and east-west traffic controls to contain credential abuse.
Government Administration
A regional government body was compromised via unpatched SharePoint, with SYSVOL-propagated ransomware threatening public records, citizen services, and compliance with NIST 800-53 and zero trust mandates.
Higher Education/Acadamia
A university was among confirmed Warlock victims, where under-resourced security teams and delayed patching cycles amplify ransomware risk from privilege escalation and disabled endpoint detection controls.
Sources
- What happens when security tools go dark before the ransomwarehttps://cyberscoop.com/warlock-ransomware-storm-2603-sharepoint-attacks-op-ed/Verified
- Microsoft Security Response Center - SharePoint Server ToolShell Vulnerabilitieshttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- Microsoft Threat Intelligence - Storm-2603 Activity Trackinghttps://www.microsoft.com/en-us/security/blog/threat-intelligence/Verified
- Congressional Research Service - Water System Cybersecurity (August 2025)https://crsreports.congress.gov/Verified
- NVD - CVE-2025-53770 Detailhttps://nvd.nist.gov/vuln/detail/CVE-2025-53770Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because Storm-2603 exploited flat network reachability and unconstrained east-west paths to escalate privileges, replicate ransomware via SYSVOL, and detonate across 33+ hosts. Enforcing workload-level segmentation and identity-aware routing would likely have reduced the blast radius significantly, even after the initial SharePoint foothold was established.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Wrapping the SharePoint workload within a Zero Trust fabric would likely constrain the web shell's ability to initiate outbound sessions or reach internal resources freely, reducing the attacker's immediate post-exploitation reachability even if the application-layer vulnerability itself could not be blocked.
Control: Zero Trust Segmentation
Mitigation: Identity-aware Zero Trust segmentation would likely reduce the scope of what a newly created or compromised service account could reach across the environment, constraining the attacker's ability to freely authenticate across workloads and limiting the administrative footprint they could accumulate during the nine-day dwell period.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely constrain the attacker's ability to freely reach domain controllers and access SYSVOL from compromised workloads, reducing the reachability needed to stage and replicate the ransomware payload at domain-wide scale through AD replication paths.
Control: Multicloud Visibility & Control
Mitigation: Centralized traffic visibility across the environment would likely surface anomalous outbound sessions initiated by non-standard processes, and policy enforcement could reduce the number of egress paths available to unauthorized remote access tools — constraining the attacker's ability to maintain persistent operator control undetected.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress enforcement would likely reduce the available outbound paths through which data could be transferred to attacker-controlled destinations, constraining bulk exfiltration by limiting which workloads can initiate large or unexpected outbound transfers to external infrastructure during the dwell period.
Because CNSF-enforced east-west segmentation and constrained SYSVOL reachability would likely have reduced the number of hosts that received the pre-staged payload, the detonation scope — even after endpoint sensors were disabled — would likely have been confined to a smaller subset of the environment rather than spreading domain-wide simultaneously.
Impact at a Glance
Affected Business Functions
- Water Distribution Control Systems and SCADA Operations
- Telecommunications Network Management and Service Continuity
- Regional Government Public Citizen Services and Administrative Systems
- University Academic and Research Information Systems
Estimated downtime: 18 days
Estimated loss: N/A
Across the four confirmed victim organizations, data at risk includes: operational technology and SCADA configuration data for the water utility (potentially enabling physical infrastructure manipulation); subscriber PII, call records, and network topology data for the telecommunications provider; citizen records, administrative credentials, and government service data for the regional government body; and student/faculty PII, research intellectual property, and academic records for the university. The use of SYSVOL for ransomware staging indicates Active Directory credential stores and domain configuration data were also at risk. Financial loss is not publicly confirmed but industry-standard ransomware recovery costs for critical infrastructure incidents of this scale typically range from $1M to $10M USD across affected entities.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Zero Trust Segmentation to contain lateral movement before the kill step: CNSF Zero Trust Segmentation with identity-based microsegmentation policies would restrict domain-wide access from a compromised SharePoint server, preventing the rogue service account from reaching SYSVOL or lateral hosts — blocking the replication-based ransomware staging that made 33-host simultaneous encryption possible.
- • Enforce East-West Traffic Security to detect and block abnormal workload-to-workload flows during dwell: CNSF East-West Traffic Security controls monitoring internal flows between the SharePoint server, domain controllers, and endpoints would have flagged anomalous service-to-service communication patterns during the nine-day reconnaissance and staging phase, providing detection opportunity before sensors were disabled.
- • Apply Egress Security and Policy Enforcement to block unauthorized outbound C2 and exfiltration channels: CNSF Egress Security with FQDN filtering and outbound policy enforcement would have restricted covert remote access tools and potential data exfiltration traffic from reaching attacker-controlled infrastructure, disrupting C2 persistence and pre-encryption data staging regardless of endpoint sensor state.
- • Leverage Multicloud Visibility and Control for centralized anomaly detection independent of endpoint sensors: CNSF Multicloud Visibility provides a network-layer observability plane that does not rely on host-resident agents — meaning that even after endpoint tools were disabled, centralized traffic observability would continue to surface anomalous interactions, repeated lateral access attempts, and suspicious automation patterns for analyst review.
- • Activate Cloud Firewall (ACF) and Inline IPS (Suricata) to block exploit traffic at the perimeter before web shell deployment: CNSF Cloud Firewall with URL filtering and Inline IPS with Suricata signature-based detection would have identified and blocked the SharePoint exploit payloads at ingress, reducing the probability of initial web shell installation and eliminating the attacker's entry point before the nine-day dwell period could begin.
