Threat research from FireIntel.

Investigations into ransomware operations and dark-web activity — what was reported, what our collection adds, and what defenders can do about it.

Threat investigation · October 2026WarlockFrom SharePoint web shell to ransomware in nine days
1. 22 JulWeb shell
2. 27 JulCanary request
3. 28 JulViewState + MSI
4. 31 JulRansomware
Warlock’s nine-day SharePoint intrusion, and the dark-web trail behind it
A host-by-host reconstruction of Warlock’s July 2026 attack on a critical-infrastructure operator, set against 78 leak-site listings, underground forum chatter and the group’s actor profile — with an ATT&CK mapping, hunting queries and indicators to download.
Threat investigation3 October 202618 min read