Warlock Ransomware Exploits Unpatched SharePoint Flaws to Target Critical Infrastructure

What happened

The Longlegs group used unpatched SharePoint zero‑day flaws to gain initial access, planted webshells, stole ASP.NET machine keys, and deployed ransomware after disabling security tools with a vulnerable signed driver.

Why it matters for trust and compliance

• The incident underscores the importance of continuous vulnerability‑management and patch‑verification controls that can be mapped to a single control objective, providing evidence for multiple compliance frameworks.
• Demonstrates a control gap in vulnerability management that continuous monitoring can surface and remediate.
• Provides audit‑ready evidence of patch status and privileged driver usage for framework‑aligned compliance.

Who is affected

Recommended actions

1. Inventory all SharePoint servers and verify they are patched to the latest Microsoft releases.
2. Enable continuous monitoring of privileged driver installations and capture remediation evidence in a control‑assurance platform.