← Back to Feed
Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack
March 16, 2026 · Trend Micro · Severity: CRITICAL
Warlock continues to enhance its attack chain with new tactics to improve persistence, lateral movement, and defense evasion using an expanded toolset: TightVNC Yuze, and a persistent BYOVD technique leveraging the NSec driver.
Key Takeaways
- Warlock continues to enhance its attack chain with new tactics for persistence and lateral movement.
- The toolset includes TightVNC, Yuze, and a persistent BYOVD technique leveraging the NSec driver.
- Warlock attacks use web shells, tunnels, and ransomware in multi-stage operations.