Warlock ransomware exploits SharePoint flaws against critical infrastructure

· Cybersecurity · China

A China-based hacking group known as Warlock is exploiting a range of Microsoft SharePoint vulnerabilities in attacks on critical infrastructure in Portuguese- and Spanish-speaking countries. Symantec's Threat Hunter Team reported the group has been exploiting these flaws since July 2025.

Why it matters：Sustained exploitation of unpatched SharePoint servers shows how collaboration platforms remain a primary intrusion vector for ransomware crews targeting essential services, pushing defenders to prioritize patch and exposure management.

Key points

  • The group exploits multiple Microsoft SharePoint vulnerabilities.
  • Attacks target critical infrastructure in Portuguese- and Spanish-speaking countries.
  • Exploitation has continued since July 2025.

Sources (original reporting)

More stories from this day