Warlock: From SharePoint Vulnerability Exploit to Enterprise Ransomware

Warlock, an emerging ransomware group, exploited internet-facing, unpatched Microsoft SharePoint servers to achieve remote code execution and pivot across networks; the campaign included privilege escalation via GPO changes and guest account manipulation, credential dumping (Mimikatz and registry hives), lateral movement over SMB and RDP, stealthy C2 tunneling via a renamed Cloudflare binary, exfiltration using a renamed RClone to Proton Drive, and deployment of ransomware (file extension .x2anylock) with extensive process and service termination routines and anti-AV tactics. The report includes technical indicators, detection/hunting queries, IoCs, and mitigation guidance for defenders.