A China-linked ransomware group called Warlock has been attacking critical infrastructure organizations including water utilities, telecommunications providers, government bodies, and universities. The group exploits SharePoint vulnerabilities to gain initial access to systems. Over the past two months, Warlock has primarily targeted organizations in Portuguese and Spanish-speaking regions across Europe, Africa, and Latin America. The group emerged in June 2025 and became notable after exploiting zero-day vulnerabilities in Microsoft SharePoint known as ToolShell.
During attacks, Warlock deploys tools that disable antivirus and endpoint detection software on multiple hosts simultaneously before launching ransomware. In one documented intrusion beginning July 22, the attacker disabled protection on at least 40 computers within two hours and deployed ransomware on 33 hosts. The attack involved installing Visual Studio Code as a service for remote access and using penetration testing tools for network reconnaissance. Security researchers note that SharePoint vulnerabilities continue to serve as effective entry points for attackers more than a year after Warlock first emerged exploiting these flaws.
Source: Read the full story at BleepingComputer
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
