Warlock Ransomware Exploits SharePoint ToolShell Zero-Day in New Attack Campaign

The article discusses the emergence of the Warlock ransomware, linked to Chinese threat actors, exploiting a critical zero-day vulnerability in Microsoft SharePoint (CVE-2025-53770). This ransomware operation, first identified in June 2025, gained attention in July when it was actively used by multiple Chinese groups, including Budworm, Sheathminer, and Storm-2603. Warlock's sophisticated attack methods include DLL sideloading and a custom command and control framework.

The operation shows connections to historical espionage activities, indicating a blend of cybercrime and state-sponsored operations. Researchers suggest that Warlock may be a rebranding of the older Anylock ransomware, with potential ties to the retired Black Basta operation. The article highlights the evolving threat landscape where espionage and ransomware activities are increasingly intertwined.