Colt Telecom Hit by WarLock Ransomware: SharePoint Zero Day Used for Mass Data Theft

 What Happened

On August 12, 2025, Colt Technology Services—a UK-based telecom giant—experienced a cyberattack that disrupted several internal support services, impacting systems like Colt Online, porting, and Voice API platforms, while core network services remained unaffected.

Who Claimed Responsibility

A threat actor using the handle "cnkjasdfgd," claiming to represent the WarLock ransomware group, offered 1 million stolen documents for US$200,000, providing sample files to prove their legitimacy.

Made Possible By

The attackers exploited a critical zero-day vulnerability in on-premises Microsoft SharePoint (CVE‑2025‑53770), which was publicly patched on July 21, 2025.

Technical Breakdown (“ToolShell” Exploit Chain)

Attackers used a sophisticated exploit chain now dubbed ToolShell, involving multiple steps:

1. Initial Access – Bypassing Authentication

A crafted HTTP POST to the /_layouts/15/ToolPane.aspx endpoint with a spoofed Referer header (/_layouts/SignOut.aspx) bypassed SharePoint’s authentication.

2. Uploading a Web Shell

A malicious ASPX file (spinstall0.aspx) was dropped into the SharePoint layouts directory.

3. Extracting MachineKeys
The web shell extracted the server’s ValidationKey and DecryptionKey, enabling attackers to generate legitimate ViewState payloads and maintain persistent, authenticated access.

4.Persistence and Evasion
Because attackers had the MachineKeys, they could continue forging payloads and re-enter even after cleanup or patching.

5. Ransomware Deployment
Intelligence links Storm‑2603, a Chinese-linked threat group, to deploying WarLock ransomware via this exploit chain

Indicators of Compromise (IOCs)

 

 

Analysis & Key Points

• Rapid Exploitation: Attackers began exploiting the SharePoint zero-day as early as July 18, with widespread abuse following soon after.
• Wide Impact: Reports suggest 75–85 servers across massively varied sectors—including government, healthcare, telecom, and energy—were affected, with thousands more at risk. 
• High Severity: With a CVSS score of 9.8, this RCE represents a high-impact vulnerability capable of unauthenticated remote code execution. 
• IOCs and Detection: Detecting the spinstall0.aspx file, relevant POST patterns, or outbound connections from compromised IPs are crucial detection methods. Defender AMSI integration and file scanning can help stop payloads. 

Threat Group Behavior: Storm‑2603 transitioned from stealthy exploitation to ransomware deployment using the compromised infrastructure, highlighting the shift from espionage to extortion.

Essential Takeaways

• Quick detection: Watch for spinstall0.aspx, unusual POST requests to ToolPane.aspx, or outbound traffic to known malicious IP addresses.
• Immediate steps: Install Microsoft’s July security updates (KB5002768, KB5002754, KB5002760), enable AMSI integration and Defender Antivirus, rotate ASP.NET MachineKeys, and isolate compromised servers.
• Broader lesson: Unpatched systems are highly vulnerable. SharePoint servers, often unwittingly exposed, make compelling targets when high-severity flaws like this go unpatched.