Friday, 22 August, 2025
Warlock Ransomware Exploits SharePoint Flaws to Launch Sophisticated Enterprise Attacks
Newly emerged Warlock ransomware is aggressively targeting unpatched on-premises Microsoft SharePoint servers using critical vulnerabilities. Attackers deploy malicious web shells via crafted HTTP POST requests to gain remote code execution, escalate privileges, steal credentials, and move laterally. They terminate security tools, encrypt files with the .x2anylock extension, and exfiltrate data using tools like RClone. The ransomware is linked to many global victims across essential sectors.
Read full story at Cybersecurity News