Warlock Ransomware Uses SharePoint ToolShell Exploits to Target Water, Telecom, and Government Systems

What happened

In late July 2026, the Warlock ransomware group exploited a chain of zero‑day vulnerabilities in Microsoft SharePoint—collectively known as ToolShell (CVE‑2025‑49704, CVE‑2025‑49706, CVE‑2025‑53770, CVE‑2025‑53771)—to compromise a water utility, a telecom operator, a regional government agency, and a university across Portuguese‑ and Spanish‑speaking regions.

Impact

The intrusions began with the attacker disabling endpoint protection on roughly 40 hosts within two hours, then deploying Warlock ransomware on 33 machines. The affected organizations experienced data encryption, service disruption, and potential data exfiltration.

What to do

Defenders should:

• Patch all SharePoint installations against the ToolShell CVEs immediately.
• Enable and harden SharePoint security controls, including least‑privilege access and multi‑factor authentication.
• Deploy EDR solutions that detect and block tools designed to disable antivirus or other defenses.
• Monitor for anomalous privilege escalation or protection‑disabling activity on endpoints.
• Verify that backups are isolated and can be restored without paying ransom.

Additional Context

Microsoft has reported that state‑backed groups and other ransomware actors are actively using ToolShell exploits, indicating a broader threat landscape.