--- title: Ransomware Disabled Security on 40 Computers. What Happened Next? description: Warlock ransomware disabled endpoint security on 40 computers, then hit at least 33 hosts. Learn why EDR alone cannot guarantee business continuity. image: https://prevent-ransomware.com/hubfs/Cybersecurity%20Shield%20Over%20Neon%20City%20-%20blog%2010-15-26.png --- [![CHIPS Cyber Defense Solutions, LLC](https://prevent-ransomware.com/hubfs/chips_blue_logo_higher_res-20210817212617.png) Cyber Defense Solutions, LLC](https://prevent-ransomware.com) ☰ [About](https://prevent-ransomware.com/about) [Solutions](https://prevent-ransomware.com/solutions) [Industries](https://prevent-ransomware.com/industries) [Resources](https://prevent-ransomware.com/resources) [Partner With Us](https://prevent-ransomware.com/meetings/tony-chiappetta/30-minute-initial-meeting) [About](https://prevent-ransomware.com/about) [Solutions](https://prevent-ransomware.com/solutions) [Industries](https://prevent-ransomware.com/industries) [Resources](https://prevent-ransomware.com/resources) [Partner With Us](https://prevent-ransomware.com/meetings/tony-chiappetta/30-minute-initial-meeting) # Ransomware Disabled Security on 40 Computers. What Happened Next? ![Tony Chiappetta](https://prevent-ransomware.com/hubfs/Tony%20LinkedIn.jpg) by [Tony Chiappetta](https://prevent-ransomware.com/blog/author/tony-chiappetta) October 15, 2026 What happens when the security software protecting your business becomes one of the first things attackers disable? In a Warlock ransomware intrusion, attackers disabled endpoint protection on at least 40 computers in approximately two hours and then deployed ransomware on at least 33 hosts. The [original Symantec and Carbon Black research](https://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructure) and [October 2 BleepingComputer report](https://www.bleepingcomputer.com/news/security/warlock-ransomware-breach-sharepoint-in-water-telecom-operator-attacks/) highlight a business continuity problem: having EDR installed does not guarantee it will remain operational during an attack. **Key Takeaway:** EDR remains essential for visibility and response, but it can become a target itself. Businesses should also restrict damaging endpoint actions and prepare to operate and recover when some security controls are unavailable. ## So what exactly happened in the Warlock ransomware attack? Researchers investigated an intrusion beginning July 22, 2026, in which attackers likely entered through vulnerabilities in on-premises Microsoft SharePoint, performed reconnaissance, used legitimate administration capabilities, and prepared their attack. The final stage occurred July 31. The attackers deployed a tool designed to disable antivirus and EDR protection to at least 40 hosts within approximately two hours. They staged Warlock ransomware in the Active Directory SYSVOL share, a trusted mechanism for distributing domain files, and ransomware appeared on at least 33 hosts. The researchers reported that ransomware appeared almost immediately as protection was disabled. The broader Warlock activity includes bring-your-own-vulnerable-driver (BYOVD) attacks, in which a signed but vulnerable driver helps tamper with defenses. Researchers identified a vulnerable K7RKScan driver in some Warlock intrusions, but did not definitively establish that it was the driver used in this particular July incident. ## Why does disabling EDR change the business impact? When attackers disable endpoint protection, defenders may lose alerts and investigation visibility precisely when malicious activity is escalating. This can make it harder to stop encryption, determine the full scope of the intrusion, and restore operations safely. For a company, the consequences can include unavailable shared files, halted applications, employee downtime, emergency IT labor, backup restoration, delayed customer service, and recovery expenses. The published research did not establish the exact financial losses or downtime in this intrusion, so those outcomes are risks rather than confirmed results for this victim. ## Does this mean EDR is ineffective or unnecessary? No. EDR provides valuable detection, investigation, and response capabilities. The lesson is that it should not be the only endpoint boundary standing between an attacker and critical operations. The [2026 Verizon Data Breach Investigations Report](https://www.verizon.com/business/resources/reports/dbir/) found ransomware involved in 48% of breaches in its dataset, while vulnerability exploitation was an initial access vector in 31%. These figures underscore the importance of reducing both entry opportunities and the damaging actions an adversary can perform afterward. ## Why should Windows businesses and MSPs pay attention? The attackers used enterprise features and trusted infrastructure against the organization. They reportedly abused Visual Studio Code tunneling for remote access and used SYSVOL to stage a ransomware payload for network-wide deployment. A capability that is legitimate in daily administration can become dangerous when an attacker controls the account or process using it. MSPs should review shared administrative practices across customers, particularly privileged access, software deployment privileges, remote support tools, Active Directory, and the security of on-premises SharePoint deployments. This case does not establish that an MSP platform was compromised, but it demonstrates why common management pathways deserve extra protection. ## Can an attack be stopped without identifying the malware? In some circumstances, yes. Detection examines evidence that activity is malicious. Isolation and Containment instead restrict what applications and processes are allowed to do, potentially preventing damaging execution without first naming the threat. What if you did not have to detect the attack in order to stop it? Attackers can change payloads, scripts, and filenames, yet often still need to execute processes, modify protected files, abuse memory, or establish persistence. Changing the attack does not necessarily change the endpoint actions required for success. AppGuard is a proven endpoint protection solution with more than a decade of production history focused on prevention through Isolation and Containment. It constrains out-of-bounds Windows endpoint behavior without requiring every attack to be recognized as malicious first. This is an additional preventive layer, not a promise to stop every threat or a replacement for EDR. ## What Should Businesses Do Next? - **Verify EDR tamper protection:** Test whether compromised privileges, services, or drivers could disable endpoint agents. - **Reduce vulnerable-driver risk:** Review Windows driver blocklists and security configuration. - **Review SharePoint exposure:** Identify on-premises servers, patch urgently, and examine privileged access. - **Protect Active Directory and SYSVOL:** Restrict administrative rights and monitor unexpected modifications. - **Add independent prevention:** Evaluate Isolation and Containment that restrict out-of-bounds endpoint behavior. - **Exercise recovery:** Test backups and incident response when dozens of machines and security agents are simultaneously unavailable. ## What is the bigger lesson for business continuity? Security software can be a target as well as a defense. Leaders should measure resilience not merely by whether EDR is deployed, but by what happens when a protection layer is bypassed or disabled. Detection and response still matter. So do prevention controls that limit attacker execution freedom before encryption starts, along with recovery plans that work under pressure. The objective is not to predict every attack. It is to restrict the actions attackers need to succeed. For related context, read [Warlock Ransomware: When Trusted Tools Become the Attack](https://prevent-ransomware.com/blog/warlock-ransomware-when-trusted-tools-become-the-attack). ###### Tags: [AppGuard,](https://prevent-ransomware.com/blog/tag/appguard) [0-day,](https://prevent-ransomware.com/blog/tag/0-day) [Ransomware,](https://prevent-ransomware.com/blog/tag/ransomware) [AI](https://prevent-ransomware.com/blog/tag/ai) ![Tony Chiappetta](https://prevent-ransomware.com/hubfs/Tony%20LinkedIn.jpg) Post by [Tony Chiappetta](https://prevent-ransomware.com/blog/author/tony-chiappetta) October 15, 2026 [![CHIPS Cyber Defense Solutions, LLC](https://prevent-ransomware.com/hubfs/chips_blue_logo_higher_res-20210817212617.png)](https://prevent-ransomware.com) AppGuard Commercial Distributor for the Americas. Mt. Juliet, Tennessee. [Follow us on LinkedIn](https://www.linkedin.com/company/chips-cyber-defense-solutions-llc) #### The Stack - [AppGuard](https://prevent-ransomware.com/AppGuard) - [Zimperium](https://prevent-ransomware.com/Zimperium) - [CyberCloak](https://prevent-ransomware.com/CyberCloak) #### Company - [About Us](https://prevent-ransomware.com/about) - [The MSP 3.0 Story](https://prevent-ransomware.com/MSP3) - [Become a Partner](https://prevent-ransomware.com/meetings/tony-chiappetta/30-minute-initial-meeting) © 2026 CHIPS Cyber Defense Solutions, LLC. All rights reserved. Built for the Best. ```json { "@context" : "http://schema.org/", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Tony Chiappetta", "url" : "https://prevent-ransomware.com/blog/author/tony-chiappetta" }, "dateModified" : "2026-10-15T9:00:00 AM", "datePublished" : "2026-10-15 09:00:00", "description" : "Warlock ransomware disabled endpoint security on 40 computers, then hit at least 33 hosts. Learn why EDR alone cannot guarantee business continuity.", "headline" : "Ransomware Disabled Security on 40 Computers. What Happened Next?", "image" : { "@type" : "ImageObject", "url" : "https://20916912.fs1.hubspotusercontent-na1.net/hubfs/20916912/Cybersecurity%20Shield%20Over%20Neon%20City%20-%20blog%2010-15-26.png" }, "mainEntityOfPage" : { "@id" : "https://prevent-ransomware.com/blog/ransomware-disabled-security-on-40-computers.-what-happened-next", "@type" : "WebPage" }, "name" : "Ransomware Disabled Security on 40 Computers. What Happened Next?", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://prevent-ransomware.com/hubfs/chips_blue_logo_higher_res-20210817212617.png" }, "name" : "CHIPS Cyber Defense Solutions, LLC" } } ``` ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Tony Chiappetta", "url" : "https://prevent-ransomware.com/blog/author/tony-chiappetta" }, "dateModified" : "2026-10-15T09:00:00.154Z", "datePublished" : "2026-10-15T09:00:00.000Z", "headline" : "Ransomware Disabled Security on 40 Computers. What Happened Next?", "image" : [ "https://prevent-ransomware.com/hubfs/Cybersecurity%20Shield%20Over%20Neon%20City%20-%20blog%2010-15-26.png" ], "mainEntityOfPage" : { "@id" : "https://prevent-ransomware.com/blog/ransomware-disabled-security-on-40-computers.-what-happened-next", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://prevent-ransomware.com/hubfs/CHIPS%20&%3B%20AppGuard%20logos.png" }, "name" : "CHIPS Cyber Defense Solutions, LLC" } } ```