Warlock Ransomware Group Disables Security Tools Before Encryption
The Warlock ransomware group, also tracked as Storm-2603 by Microsoft, has targeted organizations including a water utility and a telecom provider, likely exploiting on-premises Microsoft SharePoint vulnerabilities and disabling security software before deploying ransomware.
The Warlock ransomware group, identified by Microsoft as Storm-2603, has recently targeted at least four organizations, including a water utility and a telecommunications provider, across Europe, Africa, and Latin America. Researchers believe the attackers gained initial access through on-premises Microsoft SharePoint, potentially exploiting vulnerabilities patched over a year ago, indicating that some organizations remain vulnerable due to delayed patching.
The attack pattern observed involves a deliberate strategy to neutralize defenses before deploying the Warlock ransomware. In one documented intrusion against a critical infrastructure operator, attackers planted a web shell on a SharePoint server, spent approximately a week mapping the domain and establishing covert access, and then deployed a tool specifically designed to disable security software on numerous hosts. This disabling action was recorded on at least 40 hosts within a two-hour window.
Following the neutralization of security tools, the Warlock operators staged the ransomware in the domain's SYSVOL share, allowing Windows replication to distribute it to at least 33 hosts. The ransomware appeared on these machines almost immediately after their security protections were removed, highlighting the attackers' focus on disabling monitoring capabilities before proceeding with encryption.
This tactic directly challenges a fundamental assumption in cybersecurity budgeting: that security tools will remain operational during an attack. The attackers' ability to switch off security software means that investments in detection and response may become ineffective at the critical moment, leaving systems exposed.
While patching SharePoint and maintaining robust endpoint detection and response (EDR) capabilities remain crucial, the incident underscores the need for security controls that are resilient to tampering. Controls like tamper protection and blocking known vulnerable drivers are essential, but their effectiveness is diminished if adversaries can disable them.
The article draws an analogy to financial accounting, suggesting that security investments should be subject to an "impairment test." If an event, such as an attack that disables security tools, suggests an asset can no longer deliver its expected value, its carrying value should be re-evaluated. This "impairment" highlights that much security spending relies on a sequence of events remaining successful under duress, including sensors staying online and alerts being acted upon.
The implications are particularly significant for thinly staffed organizations, such as smaller community water systems in the United States, where limited personnel mean longer periods without active monitoring. The Warlock group's playbook, which requires no passport, demonstrates a sophisticated approach that bypasses traditional security layers by first disabling them.
To counter such tactics, the article suggests focusing on prevention that does not rely on post-attack detection. This involves implementing controls that operate at a deeper level, such as memory-resident security that can alter application layouts to disrupt malicious code execution before it can disable monitoring tools. The ultimate goal is to build defenses that remain effective even when the monitoring infrastructure is compromised.