Warlock SharePoint Ransomware: Patch, Hunt and Rotate Keys

Last updated: 26 October 2026. Sources are listed at the end.

A crew called Warlock is breaking into on-premises Microsoft SharePoint servers, switching off security tools and then encrypting whole networks. Symantec’s Threat Hunter Team published the research on 1 October 2026. BleepingComputer and The Hacker News followed on 2 and 3 October. This SharePoint ransomware campaign hit at least four organisations in roughly two months.

The named victims are a water utility, a telecom provider, a regional government body and a university. According to Symantec, all of them were in Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America. However, the method works against any unpatched SharePoint farm, so Indian companies that still host SharePoint in-house should read on.

SharePoint Online in Microsoft 365 is not part of this story. Only servers you run yourself are at risk.

The short answer

• Install the latest SharePoint security update. Subscription Edition must be on the July 2026 update or later (build 16.0.19725.20434 or higher).
• SharePoint Server 2016 and 2019 left support on 14 July 2026. Patch them to the final July 2026 build, take them off the internet, and plan the move to Subscription Edition.
• Make sure AMSI is on for every web application and Microsoft Defender (or another AMSI-aware product) is running.
• Hunt for web shells such as layout2sp.aspx and spinstall0.aspx first. Then rotate the ASP.NET machine keys.
• Check Symantec’s published indicators against your servers, SYSVOL share and proxy logs.

What the Warlock SharePoint ransomware group does

Warlock is a ransomware family that appeared in June 2025. Symantec tracks the people behind it as Longlegs, while Microsoft calls them Storm-2603. Other names include Gold Salem. Several researchers describe the group as China-linked, but that is an assessment, not a proven fact.

The group first became known for exploiting ToolShell, the SharePoint zero-day chain from July 2025. Symantec says those older bugs “likely remain” in its toolkit. Newer 2026 SharePoint flaws, flagged by CISA in July, sit alongside them. In other words, Symantec does not say which exact CVE opened the door in these four intrusions. Treat any article that names a single CVE for this campaign with caution.

How the SharePoint ransomware chain works

The attack follows a clear pattern in Symantec’s write-up:

1. First, the attackers exploit SharePoint and drop a web shell into the LAYOUTS folder. In one case, it was called layout2sp.aspx.
2. Next, the web shell reads the farm’s ASP.NET machine keys. These keys sign the __VIEWSTATE data that SharePoint trusts.
3. With the stolen keys, the attackers forge a validly signed payload. As a result, they get code running inside the SharePoint application pool.
4. Then they pull tools from file-sharing sites, add a fake service account to local Administrators and set up remote access.
5. Finally, they push an antivirus/EDR killer across the network and drop the ransomware through the domain’s SYSVOL share.

The machine key theft is the dangerous part. Because the attacker holds the signing keys, patching alone does not lock them out. You must also rotate the keys after cleaning up.

One intrusion, day by day

Symantec published a detailed timeline from one critical infrastructure victim:

The account name SPSEPRDSetup imitates a normal SharePoint setup account. So a quick glance at the Administrators group would not raise alarms.

Disabling security tools (BYOVD)

The EDR killer a.exe most likely loads a vulnerable signed driver to kill security software. This trick is known as “bring your own vulnerable driver” (BYOVD). In this case, Symantec could not identify the driver. In other attacks, the group abused the K7RKScan.sys driver (CVE-2025-1055), which DragonForce ransomware has also used.

Some roundups say Warlock disabled Microsoft Defender or used Group Policy. Symantec does not name Defender specifically. Instead, it says the tool targets antivirus and EDR in general. Also, BleepingComputer notes that staging files in SYSVOL lets attackers run them through logon scripts or Group Policy. The exact delivery method in this case was SYSVOL replication by the DFS Replication service.

Which SharePoint bugs are in play

CISA’s 14 July 2026 alert listed three SharePoint flaws under active attack. These were CVE-2026-32201 (spoofing), CVE-2026-45659 (deserialisation, needs login) and CVE-2026-56164 (privilege escalation without login). Post-exploitation included stealing IIS machine keys, which matches the Warlock playbook.

Two days later, CISA added CVE-2026-58644 to its Known Exploited Vulnerabilities (KEV) catalogue, according to The Hacker News and Tenable. CERT-EU also reports active exploitation of CVE-2026-50522 from 20 July, first spotted by watchTowr. Meanwhile, the 2025 ToolShell bugs (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771) remain a risk for any farm that missed those updates.

Sources differ slightly on the details. For example, The Hacker News and Tenable say CVE-2026-58644 needs Site Owner rights. However, NCSC New Zealand and CERT-EU describe it as unauthenticated. Either way, the fix is the same: the July 2026 update.

Am I affected?

You are at risk of SharePoint ransomware if you run SharePoint Server yourself and any of these apply:

• the farm is below the build numbers in the table;
• the server is on SharePoint 2016 or 2019 and still reachable from the internet;
• Central Administration is reachable from outside your network.

The table shows the minimum build that includes all the July 2026 fixes (from Tenable and NCSC New Zealand):

To check your farm build, open the SharePoint Management Shell as an administrator. This command is from Microsoft’s documentation and cannot be tested outside a SharePoint farm:

Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue
(Get-SPFarm).BuildVersion

Alternatively, go to Central Administration, then System Settings, then “Manage servers in this farm”.

How to fix and harden

Step 1: Patch, and face the 2016/2019 problem

Install the newest cumulative update for your version. For Subscription Edition, keep taking monthly updates. For 2016 and 2019, the July 2026 update was the last one. Therefore, any SharePoint bug found after July will stay open on those servers. Until you migrate, keep them off the internet behind a VPN or an authenticating reverse proxy. Also block outside access to Central Administration.

Step 2: Turn on AMSI, and use Full Mode where you can

AMSI lets Defender inspect web requests before SharePoint processes them. Microsoft made AMSI mandatory from the September 2025 update, so patched farms should already have it. Still, check that an AMSI-aware antivirus is running on every server.

Request body scanning in Full Mode needs Subscription Edition version 25H1 or later. It is not available on 2016 or 2019. These commands are from Microsoft’s AMSI guide (replace the URL with your web application):

$webApp = Get-SPWebApplication -Identity "https://sharepoint.example.local"
$webApp.AMSIBodyScanMode = 2   # 0 = Off, 1 = Balanced, 2 = Full
$webApp.Update()

You may need an IIS reset or app pool recycle afterwards.

Step 3: Clean first, then rotate machine keys

CISA warns that you should remove web shells and key-stealing tools before rotating keys. Otherwise, the attacker simply reads the new keys and the SharePoint ransomware crew keeps its access. Once the farm is clean, run these Microsoft cmdlets for every web application, then run iisreset on each SharePoint server:

Get-SPWebApplication | ForEach-Object {
    Set-SPMachineKey -WebApplication $_
    Update-SPMachineKey -WebApplication $_
}

Newer builds also have a “Machine Key Rotation Job” timer job that runs weekly. You can start it from Central Administration under Monitoring, then Review job definitions, then Run Now.

How to check for a SharePoint ransomware intrusion

All the commands below are read-only. We tested the file, hash and log searches with PowerShell 7 against sample files; the Windows-only parts follow Microsoft documentation.

Look for web shells in LAYOUTS

List ASPX files in the LAYOUTS folders changed in the last 120 days. Then compare them against a clean server or a fresh install:

$roots = "C:\Program Files\Common Files\microsoft shared\Web Server Extensions"
Get-ChildItem -Path $roots -Recurse -Include *.aspx -ErrorAction SilentlyContinue |
  Where-Object { $_.FullName -match '[\\/]TEMPLATE[\\/]LAYOUTS[\\/]' -and
                 $_.LastWriteTime -gt (Get-Date).AddDays(-120) } |
  Sort-Object LastWriteTime -Descending |
  Select-Object FullName, LastWriteTime, Length

Search for file names Symantec and Microsoft published

The file names come from Symantec’s Warlock report, plus spinstall0.aspx from Microsoft’s ToolShell guidance:

$names = 'layout2sp.aspx','spinstall0.aspx','a.exe','run.exe','rune.exe',
         'doexe.exe','doexeloc.dll','code-insiders.exe','how to restore your files.txt'
$paths = 'C:\Program Files\Common Files\microsoft shared\Web Server Extensions',
         'C:\Users\Public','C:\ProgramData','C:\Windows\debug'
Get-ChildItem -Path $paths -Recurse -File -Include $names -ErrorAction SilentlyContinue |
  Select-Object FullName, LastWriteTime, Length

Names like a.exe are generic, so a match needs a closer look rather than panic.

Compare hashes

Symantec lists 19 SHA-256 hashes for Warlock, the EDR killer, a vulnerable driver and malicious DLLs. Copy them from the report into warlock-sha256.txt, one per line, and run:

$ioc = Get-Content .\warlock-sha256.txt |
  ForEach-Object { $_.Trim().ToLower() } |
  Where-Object { $_ -match '^[0-9a-f]{64}$' }
Get-ChildItem 'C:\Users\Public','C:\ProgramData','C:\Windows\debug' -Recurse -File -ErrorAction SilentlyContinue |
  Get-FileHash -Algorithm SHA256 -ErrorAction SilentlyContinue |
  Where-Object { $ioc -contains $_.Hash.ToLower() } |
  Select-Object Path, Hash

Check accounts, services, SYSVOL and logs

• Run Get-LocalGroupMember -Group Administrators on each SharePoint server. Look for SPSEPRDSetup or any service-style account you did not create.
• Find VS Code tunnel services with Get-CimInstance Win32_Service | Where-Object { $_.PathName -match 'code(-insiders)?\.exe' }.
• On a domain controller, list recent files under SYSVOL\<your domain>\scripts. Symantec saw payloads in a scripts\run subfolder.
• Search proxy and DNS logs for litter.catbox.moe and xn8xyt-drop.s3.wasabisys.com, the two network indicators Symantec listed.
• In Defender, watch for Backdoor:MSIL/LeakFang.A!dha and the AMSI detections Exploit:Script/ToolPaneAuthBypass.A and .C, which CISA named.

For IIS logs, this search flags requests to the known web shells and the ToolShell entry point:

Select-String -Path 'C:\inetpub\logs\LogFiles\W3SVC*\*.log' `
  -Pattern 'layout2sp\.aspx','spinstall0\.aspx','ToolPane\.aspx' |
  Select-Object -First 50 Filename, LineNumber, Line

If anything matches, isolate the server, keep the logs and bring in incident response help before you clean up.

What this means for Indian organisations

We did not find a CERT-In advisory specific to this campaign. Even so, Indian firms, colleges and government offices that still run SharePoint 2016 or 2019 are exposed. Those systems no longer get security fixes, which makes them easy SharePoint ransomware targets.

If you are covered by CERT-In’s April 2022 Directions, a confirmed compromise must be reported to CERT-In within six hours. In addition, DPDP Rule 7 will require a breach report to the Data Protection Board within 72 hours. However, it applies only from May 2027 and is not in force yet.

Quick checklist

• ☐ Confirm the farm build with (Get-SPFarm).BuildVersion
• ☐ Apply the July 2026 update or later (latest monthly update for Subscription Edition)
• ☐ Remove SharePoint 2016/2019 from direct internet exposure and plan migration
• ☐ Block external access to Central Administration
• ☐ Verify AMSI and Defender on every server; set Full Mode on Subscription Edition 25H1+
• ☐ Hunt for layout2sp.aspx, spinstall0.aspx and new LAYOUTS files
• ☐ Compare Symantec’s hashes and check the two network indicators
• ☐ Review local Administrators, VS Code tunnel services and SYSVOL scripts
• ☐ Rotate machine keys with Set-SPMachineKey and Update-SPMachineKey, then iisreset
• ☐ Report to CERT-In within six hours if you confirm a breach

Is your farm online and you are unsure what is exposed? Our VAPT services can test it the way a SharePoint ransomware crew would. Also, read about the k0t campaign against firewall and VPN credentials, where edge systems were the first foothold.

Sources

• Symantec Threat Hunter Team: Warlock ransomware attackers hit water and telecom operators
• BleepingComputer: Warlock ransomware breach SharePoint in water, telecom operator attacks
• The Hacker News: Warlock exploits SharePoint flaws to disable security tools
• CISA: CISA urges SharePoint hardening after new exploitations (14 July 2026)
• Tenable: FAQ on CVE-2026-32201, CVE-2026-45659 and CVE-2026-56164
• CERT-EU Security Advisory 2026-009
• Microsoft Learn: Configure AMSI integration with SharePoint Server
• Microsoft Learn: SharePoint Server 2019 lifecycle

Need help finding and fixing exposed systems? Our VAPT services find unpatched and exposed systems before attackers do, and our free website safety check grades your site in seconds. Contact us for a quote.