Loading story…
Attackers used the Microsoft SharePoint remote code execution flaw CVE-2019-0604 to gain initial access and deploy Hello ransomware, according to Trend Micro. After exploiting vulnerable SharePoint servers, the intruders installed a modified China Chopper web shell, used PowerShell to fetch a Cobalt Strike beacon, and then launched the ransomware payload. The campaign was observed against organizations that had apparently not patched the long-known SharePoint vulnerability.
Hello ransomware appended the .hello extension to encrypted files and dropped ransom notes named Readme!!!.txt. The malware encrypted data with AES and protected the AES key with RSA, while also trying to block recovery by deleting shadow copies, dismounting virtual drives, removing backup-related files, and terminating backup and database services. Trend Micro said the China Chopper sample had been subtly altered, likely to evade detection, underscoring how unpatched SharePoint systems remained a viable entry point for ransomware operators.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
In January 2021, Trend Micro analyzed a Hello ransomware attack that likely gained initial access by exploiting CVE-2019-0604 on a SharePoint server. After exploitation, the attackers deployed a modified China Chopper web shell, used it to run PowerShell commands that downloaded a Cobalt Strike beacon, and then launched the ransomware payload.
CVE-2019-0604, a Microsoft SharePoint vulnerability later cited as the likely initial access vector in the Hello ransomware intrusion, was published in the CVE record.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Warlock** ransomware operators have continued exploiting unpatched **Microsoft SharePoint** servers, but recent intrusions show a more mature post-exploitation playbook focused on persistence, lateral movement, and evasion after initial access. Trend Micro reported the group is now using a **bring your own vulnerable driver (BYOVD)** technique involving the `Nsec` driver, alongside tools such as **TightVNC** and the **Yuze** reverse proxy, to move more quietly across victim networks and reduce the chance of detection. The activity has affected organizations in the technology, manufacturing, and government sectors, with observed victims in the U.S., Germany, and Russia. Incident details show the operators escalating to **full domain compromise** by abusing credentials, resetting the built-in Administrator account, and adding users to the **Domain Administrators** group. They used **PsExec**, **PowerShell Remoting**, MSI-based deployment of TightVNC, and RDP-enabling utilities to maintain remote access and spread laterally, while web shells, tunneling, and other remote-control mechanisms supported persistence and command-and-control. The reporting indicates Warlock has kept its SharePoint exploitation path consistent, but has significantly strengthened the actions that follow compromise, giving defenders a clearer set of behaviors to hunt for beyond the initial server exploit.
Jun 29, 2026
CISA updated its Known Exploited Vulnerabilities catalog to mark **CVE-2026-45659** in **Microsoft SharePoint Server** as linked to **known ransomware campaign use**, escalating concern around a flaw already tracked as actively exploited. The vulnerability is a deserialization of untrusted data issue that can let an authorized or low-privileged attacker execute arbitrary code over the network on unpatched SharePoint servers, and CISA continues to direct organizations to apply Microsoft mitigations under **BOD 26-04**. The agency had previously added the bug to the KEV catalog and required Federal Civilian Executive Branch agencies to remediate it within three days, while also urging defenders to verify patch deployment, monitor SharePoint servers for signs of exploitation, shorten patching cycles, and enable **AMSI** integration and **Microsoft Defender Antivirus** detections. Reporting cited internet scans showing more than **8,500** exposed SharePoint servers, including more than **200** still unpatched against **CVE-2026-45659**, underscoring the ongoing exposure as ransomware operators adopt the exploit.
Aug 15, 2026
Microsoft disclosed multiple on-premises SharePoint Server vulnerabilities, including remote code execution flaws `CVE-2025-49701` and `CVE-2025-49704` and spoofing flaw `CVE-2025-49706`, as defenders responded to active exploitation. Microsoft said it was working to disrupt attacks targeting exposed SharePoint environments, while the Canadian Centre for Cyber Security issued threat-detection guidance to help organizations identify compromise tied to the SharePoint vulnerabilities. Subsequent reporting tied the broader **ToolShell** exploitation chain, including `CVE-2025-53770`, to China-linked operators that breached a Middle Eastern telecom provider, government departments in Africa, government agencies in South America, and a U.S. university. Investigators said the intrusions used malware and tooling including **Zingdoor**, **ShadowPad**, **KrustyLoader**, and **Sliver**, alongside credential-dumping, proxying, DLL sideloading, and persistence techniques, indicating a stealthy espionage-focused campaign that expanded beyond initial public understanding of the SharePoint attacks.
Jun 29, 2026