China-linked Warlock ransomware exploits SharePoint flaws in critical-infrastructure attacks

· Cybersecurity

A suspected China-linked ransomware group called Warlock is exploiting Microsoft SharePoint vulnerabilities to break into organizations, disable security tools and deploy ransomware. Reported victims include a water utility, a telecom provider, a regional government body and a university, mainly in Portuguese- and Spanish-speaking countries.

Why it matters：The attacks affect organizations in critical infrastructure sectors and show how ransomware groups are exploiting software vulnerabilities to disable defenses and extort victims.

Key points

  • Warlock exploits both old and new SharePoint flaws for initial access
  • Attacks were observed by the Symantec and Carbon Black Threat Hunter Team
  • Victims span water, telecom, government and education sectors

Sources (original reporting)

More stories from this day