Log in Request a demo

Ransomware group profile

Warlock

Also known as Storm-2603

Warlock is a ransomware family that Microsoft says a China-based actor it tracks as Storm-2603 deployed in July 2025 after exploiting on-premises SharePoint servers.

In short

Warlock is a ransomware family that Microsoft says a China-based actor it tracks as Storm-2603 deployed in July 2025 after exploiting on-premises SharePoint servers. CISA's alert on the same flaws says actors were seen encrypting files and distributing Warlock on compromised systems.

Profile MapRansomware Group
  1. Other Names1names in public reportsStorm-2603
  2. Entry Routes6ways inSharePoint ToolShell flaws · Web shells and .dll payloads · Stolen ASP.NET MachineKeys
  3. Techniques2mapped to MITRE ATT&CKData Encrypted for Impact · OS Credential Dumping
  4. Defences8first steps listedPatch SharePoint · Turn on AMSI

Overview

Warlock is a ransomware family. Microsoft says a China-based actor it tracks as Storm-2603 used it in July 2025 after breaking into on-premises SharePoint servers through the ToolShell flaws. Microsoft rates its China-based assessment as moderate confidence and says it has found no links between Storm-2603 and other known Chinese threat actors. In its July 23, 2025 update, Microsoft names the activity as Storm-2603 exploitation leading to the deployment of Warlock ransomware.

Where it was seen

CISA’s alert on the SharePoint flaws says threat actors have been observed encrypting files and distributing Warlock ransomware on compromised systems. MITRE records the ToolShell campaign (C0058) as running in July 2025 and lists ransomware including 4L4MD4R and Warlock. MITRE says the campaign hit finance, education, energy and healthcare across Asia, Europe and the United States. That list covers the whole campaign, not Warlock alone.

How an attack runs

Microsoft describes the chain this way. The actor exploits the SharePoint flaws to get in. It then uses Mimikatz to pull passwords from the memory of the Windows security process (LSASS). It moves sideways with PsExec and the Impacket toolkit, running commands over Windows Management Instrumentation (WMI). Finally it edits Group Policy Objects (GPO) so that Warlock is pushed to many machines at once. Microsoft also lists attempts to switch off Defender protections through registry edits.

Microsoft also ties the actor to attempts to steal MachineKeys, the ASP.NET keys that SharePoint uses. That is why both Microsoft and CISA tell defenders to rotate those keys after patching. CISA adds that .dll payloads, not only .aspx and .exe web shells, have been seen in this exploitation.

Motive is not settled

Microsoft says it has seen this actor deploy Warlock and Lockbit ransomware in the past, and that it cannot confidently assess the actor’s objectives. The same exploits were also used by two Chinese state actors, Linen Typhoon and Violet Typhoon, which Microsoft tracks separately.

Flaws and files seen

Microsoft lists four CVEs in this activity: CVE-2025-53770 (ToolShell authentication bypass and remote code execution), CVE-2025-53771 (path traversal), CVE-2025-49704 (remote code execution) and CVE-2025-49706 (post-authentication remote code execution). CISA describes CVE-2025-53770 and CVE-2025-53771 as patch bypasses for CVE-2025-49704 and CVE-2025-49706. Microsoft reports a web shell named spinstall0.aspx used to steal MachineKeys, with variants such as spinstall1.aspx and spinstall2.aspx, and names the tools Mimikatz, PsExec, the Impacket toolkit and a reverse proxy tool, xd.exe.

MITRE record

MITRE’s campaign page for ToolShell (C0058) lists techniques that include Exploit Public-Facing Application (T1190), Server Software Component: Web Shell (T1505.003), Windows Management Instrumentation (T1047), PowerShell (T1059.001) and Data Encrypted for Impact (T1486). It names Impacket (S0357), Mimikatz (S0002), ngrok (S0508) and PsExec (S0029) as software used in the campaign. As above, this is a campaign-wide record, not a Warlock-only one.

What to look for

CISA advises watching for requests with the referrer /_layouts/SignOut.aspx and for POST requests to /_layouts/15/ToolPane.aspx?DisplayMode=Edit. CISA’s alert was updated on July 22, 24, 31 and August 6, 2025.

Warlock and SharePoint ToolShell
  1. July 2025ToolShell campaignMITRE dates the first waves of exploitation of the SharePoint flaws to July 2025.
  2. July 18, 2025Ransomware seenMicrosoft says it saw Storm-2603 deploy ransomware through these flaws from this date.
  3. July 20, 2025KEV listingCISA added CVE-2025-53770 to its Known Exploited Vulnerabilities catalog.
  4. July 22, 2025Earlier CVEs listedCISA added CVE-2025-49706 and CVE-2025-49704 to the catalog.
  5. July 23, 2025Warlock namedMicrosoft updated its blog with analysis of Storm-2603 leading to Warlock ransomware.
  6. July 24, 2025CISA updateCISA added details on the deployment of ransomware and new web shells.
  7. July 31 and August 6, 2025Further CISA updatesCISA’s alert received two more updates.

At a glance
Name
Warlock ransomware
Actor named by Microsoft
Storm-2603 (China-based, moderate confidence)
Main entry seen
On-premises SharePoint, ToolShell flaws
Spread method
Group Policy Objects
Credential tool
Mimikatz
Campaign record
MITRE C0058, July 2025

Also known as

  • Storm-2603

How they get in

  1. 01

    SharePoint ToolShell flaws

    Microsoft says Storm-2603 exploited the on-premises SharePoint vulnerabilities, including CVE-2025-53770, to deploy ransomware from July 18, 2025. CISA added CVE-2025-53770 to its Known Exploited Vulnerabilities catalog on July 20, 2025.

  2. 02

    Web shells and .dll payloads

    CISA notes that beyond the usual .aspx and .exe web shells, .dll payloads were seen during this exploitation. They are harder to detect and can be used to obtain machine keys.

  3. 03

    Stolen ASP.NET MachineKeys

    Microsoft tracks the actor in association with attempts to steal MachineKeys using the SharePoint flaws. Stolen keys are why key rotation is part of the advice.

  4. 04

    Patch bypass CVEs

    CISA describes CVE-2025-53770 and CVE-2025-53771 as patch bypasses for CVE-2025-49704 and CVE-2025-49706, the flaws MITRE places at the start of the ToolShell campaign.

  5. 05

    spinstall0.aspx web shell

    Microsoft reports a web shell named spinstall0.aspx, with variants spinstall1.aspx and spinstall2.aspx, deployed for MachineKey theft.

  6. 06

    Post-exploit tools

    Microsoft names Mimikatz, PsExec, Impacket and the xd.exe reverse proxy tool. MITRE adds ngrok to the campaign's software list.

How they extort

The opened sources describe file encryption and distribution of the ransomware through Group Policy. They do not describe a leak site or ransom note, so none is claimed here.

Who they target

  1. 01

    Financial services

    See the industry page
  2. 02

    Education

    See the industry page
  3. 03

    Energy and utilities

    See the industry page
  4. 04

    Healthcare

    See the industry page

How to defend

  1. Patch SharePoint

    Apply the security updates Microsoft released for the SharePoint flaws, as both Microsoft and CISA advise.

  2. Turn on AMSI

    Configure the Antimalware Scan Interface (AMSI) in SharePoint as Microsoft indicates and run antivirus on all SharePoint servers.

  3. Take exposed servers offline if needed

    If AMSI cannot be enabled, CISA says to disconnect affected public-facing products from service until official mitigations are available.

  4. Rotate machine keys, then restart IIS

    Rotate the ASP.NET machine keys, apply the update, rotate again and restart the IIS web server, per CISA. Microsoft gives the same rotate and restart advice.

  5. Deploy endpoint detection

    Microsoft recommends Defender for Endpoint, or an equivalent, to detect and block post-exploit activity. CISA advises EDR protections.

  6. Watch Group Policy and credential access

    The sources show Group Policy changes, Mimikatz use against LSASS and Defender being switched off through the registry. These are worth alerting on.

  7. Watch for ToolShell request patterns

    CISA advises monitoring for requests with the referrer /_layouts/SignOut.aspx and POSTs to /_layouts/15/ToolPane.aspx?DisplayMode=Edit.

  8. Use Full Mode for AMSI

    Microsoft advises configuring AMSI integration in SharePoint and enabling Full Mode for best protection, and running EDR in block mode.

Questions

What is Warlock ransomware?

Warlock is a ransomware family that Microsoft says a China-based actor it tracks as Storm-2603 deployed in July 2025 after exploiting on-premises SharePoint servers. CISA says actors were seen encrypting files and distributing Warlock.

Who is behind Warlock?

Microsoft attributes it to Storm-2603, a China-based actor, with moderate confidence. Microsoft says it found no links to other known Chinese threat actors and cannot confidently assess the actor's objectives.

How does a Warlock attack run?

Per Microsoft, the actor exploits the SharePoint ToolShell flaws, pulls passwords from LSASS memory with Mimikatz, moves sideways with PsExec and Impacket, then edits Group Policy Objects so Warlock is pushed to many machines at once.

How do I defend against Warlock?

Patch the SharePoint flaws. Microsoft and CISA also tell defenders to rotate the ASP.NET MachineKeys after patching, because the actor tried to steal them. CISA adds that .dll payloads, not only web shells, have been seen.

What systems does Warlock target?

In the cases described, it was deployed after exploitation of on-premises SharePoint servers. MITRE says the wider ToolShell campaign hit finance, education, energy and healthcare across Asia, Europe and the United States, not Warlock alone.

Which CVEs are linked to Warlock attacks?

Microsoft lists CVE-2025-53770, CVE-2025-53771, CVE-2025-49704 and CVE-2025-49706 for the SharePoint exploitation in which Storm-2603 deployed Warlock.

How can I spot ToolShell exploitation on SharePoint?

CISA advises watching for requests with the referrer /_layouts/SignOut.aspx and POST requests to /_layouts/15/ToolPane.aspx?DisplayMode=Edit, and for .dll payloads as well as .aspx web shells.

In our research

  1. Warlock Group: The Rise of GOLD SALEM (Storm-2603) in the Ransomware Landscape March 2026
  2. FIN11 (DEV-0950 / Lace Tempest / TA505 / TEMP.Warlock / UNC902): A 1000-Word Intelligence January 2026

Sources

  1. Disrupting active exploitation of on-premises SharePoint vulnerabilities Microsoft
  2. UPDATE: Microsoft Releases Guidance on Exploitation of SharePoint Vulnerabilities CISA
  3. SharePoint ToolShell Exploitation, Campaign C0058 MITRE ATT&CK

Last updated October 2026

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Ransomware

Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.

Read more

Glossary term

Data leak site

A data leak site is a website where attackers publish data stolen from a victim.

Read more