Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack

The Warlock ransomware group has enhanced its attack chain with improved methods for persistence, lateral movement, and evasion. Their updated toolset includes TightVNC, Yuze, and a persistent BYOVD technique exploiting the NSec driver. The group's primary targets were technology, manufacturing, and government sectors, with the US, Germany, and Russia being the most affected countries. Warlock continues to exploit unpatched Microsoft SharePoint servers for initial access, and has expanded its post-exploitation toolkit. New additions include TightVNC for persistent remote access, Yuze for establishing SOCKS5 connections, and a BYOVD technique using the NSecKrnl.sys driver to terminate security products. The group also leverages Velociraptor, VS Code tunnels, and Cloudflare Tunnel for C&C communications.

Pulse ID: 69b7e2efd7e29c4058daf6d6
Pulse Link: https://otx.alienvault.com/pulse/69b7e2efd7e29c4058daf6d6
Pulse Author: AlienVault
Created: 2026-03-16 11:01:03

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CandC #Cloud #CyberSecurity #Germany #Government #InfoSec #Manufacturing #Microsoft #OTX #OpenThreatExchange #RansomWare #Russia #VNC #bot #socks5 #AlienVault

LevelBlue - Open Threat Exchange

Learn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

LevelBlue Open Threat Exchange

Let's all take a moment to celebrate this underappreciated masterpiece.

#videogames #rts #commandandconquer #candc #kanelives!

Uuh, EA open sourced some of it‘s iconic Command & Conquer games.

#EA #CommandAndConquer #CAndC #OpenSource #GitHub #Games #GameDev #IndieGameDev #Gameing

Clivilles' & Cole - A Deeper Love (B2 A Deeper Feeling Mix)

YouTube

Finished the #ShadowsOfTheHalflingHall #CastelsAndCrusades #CAndC adventure last night with my group.

I'm still really pleased with the game. Most of the players appreciate the simple resolution mechanic and how fast we can move through things.

I also came to realize that I tend to run most of my #TTRPG sessions much more old school than I initially realize.

I like to give them puzzles with no clear or set resolution and watch them come up with the cleverest solutions then let them make some rolls. They get so excited and it's a lot of work and planning off of my shoulders.

#OSR #GMLife

Nice day out yesterday on inaugural #CandC #BillyBlandChallenge club training #run on #TherfieldHeath, near #Royston. About the best #hills we get around here, which is a bit sad for a #FellRunning group! https://strava.app.link/onTgECAYWub