Warlock Ransomware Breaches SmarterTools Through Unpatched SmarterMail Server

Warlock Ransomware Breaches SmarterTools Through Unpatched SmarterMail Server

The Warlock ransomware gang breached SmarterTools’ network by exploiting an unpatched SmarterMail instance, compromising approximately 12 Windows servers and affecting hosted customers using SmarterTrack. The incident occurred on January 29, 2026, when a mail server that was not updated to the latest version was compromised, allowing the attackers to gain initial access and later deploy encryption payloads.

Why This Matters

The breach highlights the importance of keeping software up-to-date, as the exploitation of critical vulnerabilities can have severe consequences, including data encryption and financial losses. In this case, the attackers exploited CVE-2026-24423, a vulnerability that allows for unauthenticated remote code execution, to gain access to the SmarterMail instance. The failure to patch this vulnerability in a timely manner resulted in a significant breach, affecting not only SmarterTools’ internal systems but also its customers.

Key Insights

• CVE-2026-24423 exploitation allowed for unauthenticated remote code execution: This vulnerability was exploited by the Warlock ransomware gang to gain initial access to the SmarterMail instance.
• SmarterMail build 9511 addressed the vulnerabilities: Users of SmarterMail are advised to upgrade to the latest version (Build 9526) for optimal protection.
• Velociraptor was used for digital forensics and maintaining access: The attackers installed Velociraptor, a legitimate digital forensics tool, to maintain access and set the stage for ransomware deployment.

Working Example

No code is available for this specific context.

Practical Applications

• Use Case: SmarterTools’ experience highlights the importance of regular software updates and vulnerability patching to prevent similar breaches.
• Pitfall: Failing to keep software up-to-date can result in significant breaches, as seen in the case of SmarterTools, where an unpatched SmarterMail instance was exploited by the Warlock ransomware gang.

References:

• http://thehackernews.com/2026/02/warlock-ransomware-breaches.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24423
• https://www.smartertools.com/community/a-175172/smartermail-security-incident.aspx