Successful exploitation allows full remote code execution on the SharePoint Server. Microsoft has documented concurrent attack activity where Storm-2603 deployed Warlock ransomware following SharePoint exploitation, using tools including Velociraptor, Cloudflare tunnelling, Zoho Assist, and SSH connections via Visual Studio Code. A vulnerable driver (NSecKrnl.sys) was used to tamper with endpoint security controls. A second simultaneous attacker in the same environment used DLL side-loading and custom backdoors, with lateral movement confirmed into a second organisation.