A China-linked group is using Warlock ransomware to attack critical infrastructure and public-sector organizations in Portuguese- and Spanish-speaking countries. Symantec says the attackers are exploiting multiple Microsoft SharePoint vulnerabilities, including the older 2025 'ToolShell' bugs and newer 2026 SharePoint flaws recently highlighted by CISA, to reach a water utility, a telecommunications provider, a university, and a regional government across Europe, Africa, and Latin America. In at least one case, the attackers also deployed a tool to disable security software across dozens of systems before encrypting them.
Why it matters: Organizations running on-premises Microsoft SharePoint should treat this as urgent because unpatched servers are still being used as an entry point for ransomware against essential services. Defenders should patch SharePoint immediately, review internet-exposed deployments, and hunt for post-compromise activity such as security-tool tampering and admin-like lateral movement.
info@thehackernews.com (The Hacker News)
2026.10.03
96% relevant
This appears to be the same underlying Warlock ransomware campaign and adds concrete tradecraft details about post-exploitation behavior, including disabling security tools before deploying ransomware on compromised SharePoint environments.
Ionut Ilascu
2026.10.02
97% relevant
This directly updates the same Warlock/Longlegs campaign, adding victim-sector detail (water utility, telecom provider, regional government, university), timing, and tradecraft including a web shell on on-premises SharePoint, BYOVD with the K7RKScan driver vulnerable to CVE-2025-1055, VS Code tunneling, SYSVOL staging, NetExec use, and ransomware deployment across dozens of hosts.
2026.10.02
100% relevant
This article establishes a distinct 2026 campaign in which the Warlock ransomware group continues exploiting Microsoft SharePoint vulnerabilities to target critical infrastructure and government-related organizations across multiple regions.
← Back to all stories