GOLD SALEM: A New Ransomware Group Is Exploiting SharePoint Flaws

GOLD SALEM, also known as the Warlock Group, has been exploiting SharePoint flaws since March 2025, publishing details of 60 victims across North America, Europe and South America by mid-September 2025. The group used a chain of vulnerabilities—CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771—to drop an ASPX web shell that executed arbitrary commands through the IIS worker process, with one observed payload downloading a Golang-based WebSockets server to give attackers persistent access.

They also leveraged Bring Your Own Vulnerable Driver (BYOVD), using a Baidu Antivirus driver renamed googleApiUtil64.sys vulnerable to CVE-2024-51324 to terminate EDR agents. Microsoft reported that GOLD SALEM used Mimikatz against LSASS, PsExec and Impacket for lateral movement, and deployed the Warlock ransomware payload through Group Policy Objects, while in August a campaign abused Velociraptor to establish a Visual Studio Code network tunnel for remote persistence.

According to Sophos, as of 16 September data from 19 of 60 listed victims (32%) was published on the group’s leak site, and data from 27 victims (45%) had been sold to private buyers, potentially in response to ransom nonpayment, underscoring a sophisticated playbook and the need for aggressive patching of internet-facing services.