Storm-2603 disabled security tools before deploying Warlock
Original title: What happens when security tools go dark before the ransomware
Researchers say the group hit a water utility, a telecom, a regional government and a university after SharePoint access.
Researchers reported on October 1 that Storm-2603, the China-linked group behind Warlock, attacked at least four organizations in the prior two months across Portuguese- and Spanish-speaking countries. In one critical-infrastructure intrusion, attackers planted a SharePoint web shell on July 22, then on July 31 disabled security software on at least 40 hosts within about two hours and staged Warlock in SYSVOL so it reached at least 33 hosts. The column argues detection spending fails if those sensors can be switched off.
Unconfirmed: SharePoint and ToolShell as the intrusion path are described as researchers' belief, not a confirmed CVE exploit in these cases.
- Victims included a water utility, telecom provider, regional government body and university.
- The activity was in Europe, Africa and Latin America, and none of these victims were in the United States.
- Researchers say the likely entry was on-premises SharePoint, including ToolShell flaws from July 2025.
- A created account resembling a SharePoint service account was added to local administrator groups.
- The Congressional Research Service says 81% of nearly 49,500 US community water systems are small.
Impact: Security tools disabled, then ransomware deployed across domain hosts
| Product | Affected |
|---|---|
| Microsoft SharePoint | — |
- 1.Patch on-premises SharePoint, including the older ToolShell fixes.
- 2.Turn on tamper protection and block known vulnerable drivers.
- ATT&CK
- T1505.003 Web ShellT1562.001 Disable or Modify ToolsT1136.001 Local AccountT1486 Data Encrypted for Impact
- Vendors
- Microsoft
- Products
- SharePoint
- Threat actors
- Storm-2603
- Malware
- Warlock
- Countries
- China
From the original article
6 min read at cyberscoop.com
A China-linked ransomware crew disabled the security tools at a critical infrastructure operator before it launched the encryptor. Most security budgets never priced that in. The post What happens when security tools go dark before the ransomware appeared first on CyberScoop.
By Greg Otto · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.