Warlock Hackers Are Quietly Killing Security Tools Before Ransomware Hits

Michael Miller · 2026-10-03

You know that feeling when you lock your front door, but someone's already inside? That's basically what's happening with a threat actor called Warlock. They're slipping into Microsoft SharePoint, turning off the alarm system, and then letting the ransomware loose. Symantec and Carbon Black's Threat Hunter Team caught this. The targets? Critical infrastructure, government agencies, and schools in Portuguese- and Spanish-speaking countries. But don't let the geography fool you. These tactics travel fast. ### Why SharePoint Is the Weak Spot SharePoint is everywhere. It's the digital filing cabinet for millions of organizations. But if it's not patched, it's like leaving the back door unlocked. Warlock is exploiting both old and new flaws. They don't need a zero-day every time. Sometimes the old bugs still work because nobody updated. Here's the scary part: they're not just stealing data. They're disabling security tools first. Think of it as cutting the phone lines before the break-in. ### The Playbook: Disable, Then Destroy According to the researchers, the attack chain looks something like this: - Gain initial access through a SharePoint vulnerability - Move laterally to find and disable endpoint protection - Deploy ransomware once defenses are down - Demand payment before anyone realizes what happened > "They're not smashing windows. They're turning off the lights and walking out the front door with your safe." – a security researcher familiar with the case That quote sums it up. It's quiet, methodical, and devastating. ### What This Means for You If you're running SharePoint on-premises, you need to patch. Yesterday. If you're in the cloud, check your configurations. Warlock isn't picky. They'll take whatever door is open. Also, don't assume you're too small to be a target. Schools and local government offices are on the list. These groups often have tight budgets and older systems. That's exactly why they get hit. ### The Bottom Line Warlock is still active. The attacks are ongoing. And the playbook works because too many organizations treat security as a one-time setup instead of a daily habit. So, what do you do? Patch. Monitor. And assume that someone might already be inside. Because with Warlock, that's not paranoia. It's pattern recognition. Stay safe out there.