How FileSure Would Have Stopped the Warlock Ransomware Attacks on Schools

The Attack: Warlock Ransomware Exploits SharePoint to Hit Education

The Warlock ransomware group exploited a Microsoft SharePoint vulnerability to breach educational institutions, including the University of Illinois Chicago’s College of Medicine and Spokane Public Schools. The attacks resulted in data theft and file encryption, compromising student records, staff information, and medical data. The article correctly identifies the problem: schools run a mix of modern and legacy systems, face budget constraints, and struggle to patch quickly enough to stay ahead of attackers.

The recommended defenses — EDR, vulnerability management, security awareness training, and robust backups — are all valid. But they share a common limitation: they’re reactive. EDR detects threats it recognizes. Patching closes vulnerabilities after they’re discovered and after you’ve tested the patch and after you’ve scheduled the maintenance window. Training reduces the likelihood of a successful phish, but it doesn’t eliminate it. Backups let you recover after you’ve already been hit.

What if you could stop ransomware before it encrypts a single file, regardless of whether anyone has seen that variant before?

How Ransomware Actually Works — And Where to Stop It

Ransomware has to write encrypted versions of your files to your hard drive. There’s no way around this technical requirement. The malware reads your original file, encrypts it in memory, and writes the encrypted version back to disk, usually deleting or overwriting the original.

That write operation happens at the Windows kernel level — the deepest layer of the operating system, where all file system operations are processed before they complete.

FileSure Defend operates at exactly that layer, via a kernel filter driver. It intercepts every file operation — create, write, read, delete, rename — before it completes. You define rules: which users, which programs, which machines can perform which operations on which files.

When Warlock ransomware lands on a system via the SharePoint exploit and tries to write its payload to disk, FileSure evaluates the operation against your rules. If the program attempting the write isn’t on your authorized list, the operation is blocked. The payload never lands. The ransomware never executes. Your files are never touched.

A simple rule would look like this:

Operation: Block file writes of executable file types (.exe, .dll, .sys)
Program filter: Email clients, web browsers, document viewers — anything that receives files from outside
Scope: All local drives
Alert: Yes — log the attempt and notify the IT team

This rule prevents the initial payload from being written to disk when it arrives via email, web download, or exploited web application like SharePoint. The attack stops at the delivery stage, before execution, before encryption, before data theft.

For schools specifically, this matters because:

• Legacy systems are protected. FileSure runs on Windows XP through Windows 11 and Server 2003 through Server 2022. That library computer running Windows 7 because the catalog software won’t run on anything newer? It’s covered.
• No signature updates required. A ransomware variant from this morning is stopped the same way as one from five years ago. Your protection doesn’t depend on whether your vendor has seen the threat yet.
• Compliance audit trails. FERPA requires schools to control and document access to student records. HIPAA applies to medical school data. FileSure logs every file operation with user, program, timestamp, and machine — exactly what auditors ask for.
• Works offline. A laptop taken home by a teacher is protected even when it’s disconnected from the school network. The rules are enforced locally by the kernel driver.

The Upstream Intervention

The article’s recommendations aren’t wrong — they’re just downstream. EDR detects ransomware after it’s running. Backups restore data after it’s been encrypted. Patching closes the door after the vulnerability has been exploited in the wild.

Blocking unauthorized file writes at the kernel level is the upstream intervention. The malware payload never lands on disk, so it never runs, so it never encrypts anything, so you never need the backup.

You still need the other layers — defense in depth is real. But when the scumbag finds a zero-day SharePoint vulnerability and your patch is three weeks out because you’re waiting for Microsoft to release it and then waiting for your testing window, kernel-level file operation control is what keeps your student records intact.

Start a free 21-day trial at bystorm.com and test it on your own systems. Install FileSure on a test machine, run our simulated ransomware test file, and watch it get blocked in real time. Then try opening a Word document and see the access get logged. That’s the whole demo. It works exactly like that, every time.

Source: Devastating: Warlock Ransomware Exposes Critical Flaws – Here’s How to Protect Schools from Ransomware – Dr. Matthew Lynch

Category: Ransomware

Tags: warlock ransomware, education sector, sharepoint vulnerability, kernel filter driver, file system security, ferpa compliance, zero-day protection, legacy windows systems