Warlock Ransomware Exploits ToolShell SharePoint Vulnerabilities

First seen 2 Dec 2025, 18:33 UTC • Reddit

•23

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Warlock ransomware has been deployed through vulnerabilities in ToolShell SharePoint. Organizations using affected SharePoint versions are at risk, as the ransomware exploits chained vulnerabilities to gain access. Technical details indicate that the attack vector relies on specific weaknesses within the SharePoint infrastructure.

Ask AI about this cluster

Answers cite the sources they use

How this analysis works

Attack Flow

Continue Reading

Microsoft SharePoint Attacks: Over 400 Victims Including US Agencies Warlock Ransomware Group Enhances Attack Techniques with BYOVD and Remote Access Tools Qilin and Warlock Ransomware Exploit Vulnerable Drivers to Compromise EDR Tools Ransomware Tactics Evolve: EDR Killers Expand Beyond Vulnerable Drivers Payroll Pirate Campaign Targets Payroll Systems Using AiTM Session Hijacking Critical RCE Vulnerability in BeyondTrust Software Requires Immediate Patching

Warlock Ransomware Exploits ToolShell SharePoint Vulnerabilities

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading