Warlock Threat Actor Exploits SharePoint Flaws to Deploy Ransomware

The China-linked Warlock group is targeting critical infrastructure and government entities in Spanish- and Portuguese-speaking regions. They weaponize Microsoft SharePoint vulnerabilities to disable security tooling and deploy ransomware. Administrators must ensure all SharePoint instances are patched and monitor environments for anomalous execution patterns.