Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack

This TrendAI report documents an active Warlock (aka Water Manaul) ransomware campaign that exploited unpatched Microsoft SharePoint servers for initial access, spent days performing credential theft and lateral movement (including DCSync and PsExec/PSRemoting), expanded its toolkit to add persistent remote access (TightVNC), multiple covert C2 channels (Velociraptor, Cloudflare Tunnel, VS Code tunnels, Yuze), and a BYOVD kernel-level technique abusing the NSecKrnl.sys driver to disable security products and deploy ransomware across the domain via GPO; the report includes IoCs, indicators, and layered mitigation recommendations.