Warlock Exploits SharePoint Flaws to Breach Water, Telecom Targets

· Cybersecurity

The suspected China-linked ransomware group Warlock is exploiting Microsoft SharePoint vulnerabilities to gain initial access, hitting a water utility, a telecom provider, a regional government body and a university. Symantec and Carbon Black researchers say attacks continue against organizations in Portuguese- and Spanish-speaking countries, with the group disabling security tools before deploying ransomware.

Why it matters：Unpatched collaboration platforms remain a primary entry point for ransomware crews, and critical-infrastructure victims show the risk extends well beyond corporate data theft.

Key points

  • Attackers exploit both old and new SharePoint flaws for initial access.
  • Security tools are disabled before ransomware is deployed.
  • Victims span utilities, telecom, government and education sectors.

Sources (original reporting)

More stories from this day