Warlock Attackers Abuse Vulnerable Driver to Disable Security Tools Before Ransomware Deployment

Warlock (attributed to Longlegs/Storm-2603) is actively exploiting SharePoint 'ToolShell' zero-days and other SharePoint flaws to drop webshells, steal ASP.NET machine keys, forge ViewState deserialization payloads, sideload malicious DLLs, and use a vulnerable signed driver (K7RKScan) to terminate security processes before deploying ransomware across multiple organizations globally; the report includes attack timelines, TTPs, recommended mitigations (patching SharePoint, rotating machine keys, blocking vulnerable drivers, monitoring SYSVOL and msiexec activity) and IOCs (domains and SHA-256 hashes).