Emulating the Expedited Warlock Ransomware

AttackIQ has released a new attack graph that emulates the behaviors exhibited by Warlock ransomware, which emerged in June 2025. Beginning in July, Warlock operators have primarily targeted internet-exposed, unpatched on-premises Microsoft SharePoint servers, exploiting a set of recently disclosed zero-day vulnerabilities, specifically CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771, collectively referred to as the “ToolShell” exploit chain.

The post Emulating the Expedited Warlock Ransomware appeared first on AttackIQ.

The post Emulating the Expedited Warlock Ransomware appeared first on Security Boulevard.