Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware

The suspected China-linked threat actor Warlock continues to exploit Microsoft SharePoint vulnerabilities, both old and new, to disable security tools and deploy ransomware. Attacks target organizations in Portuguese- and Spanish-speaking countries, including critical infrastructure, government, and education sectors. The activity was observed by Symantec and Carbon Black Threat Hunter Team, highlighting ongoing risks from SharePoint flaws.