Warlock Ransomware Hits US Firms Exploiting SharePoint Zero-Day, Linked to China’s CamoFei APT

Researchers from Symantec and Carbon Black have published a detailed analysis of Warlock ransomware, describing it as a newly emerging threat that debuted in June 2025 and was used to exploit the ToolShell zero-day vulnerability in Microsoft SharePoint (CVE-2025-53770). Unlike many ransomware operations traditionally tied to Russia or Eastern Europe, Warlock is noted for strong links to Chinese threat actors and overlaps with espionage-focused groups such as CamoFei (aka ChamelGang).

In July 2025, three China-linked actors—Budworm (APT27), Sheathminer (APT31), and Storm-2603—were reported to have exploited the zero-day, with Storm-2603 identified as the group deploying Warlock and LockBit 3.0 payloads in these attacks. The analysis also highlights BYOVD techniques to disable security tools, the use of a stolen digital certificate issued to a fictitious developer named coolschool, and a Baidu driver renamed googleapiutil64.sys as part of the operation. According to Symantec and Carbon Black, these overlaps trace back to CamoFei’s earlier identified toolkit and activities dating to 2019.