Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware

A suspected China-linked threat actor known as Warlock is actively exploiting Microsoft SharePoint vulnerabilities to target organizations in Portuguese- and Spanish-speaking countries. The campaign has been observed by Symantec and Carbon Black Threat Hunter Team. Targeted sectors include critical infrastructure, government, and education. The actor is leveraging both old and new SharePoint flaws. The attacks involve disabling security tools as part of the intrusion chain before deploying ransomware. The campaign represents a continued and ongoing threat rather than a one-time incident.