How Warlock Ransomware Targets Vulnerable SharePoint Servers

Trend Micro research details how the Warlock ransomware gang (a LockBit-derived variant linked to Storm-2603) exploited multiple on-premises Microsoft SharePoint vulnerabilities (CVE-2025-49706, CVE-2025-49704, CVE-2025-53770, CVE-2025-53771) to gain code execution, escalate privileges via GPO changes, perform credential dumping (Mimikatz), move laterally over SMB, use DLL sideloading and Cloudflare tunnels for C2, and deploy ransomware; the report emphasizes active exploitation, scale of impact on government and private organizations, and urges immediate patching and layered defenses.