Warlock Hacks SharePoint: Security Tools Disabled, Ransomware Unleashed

Michael Miller · 2026-10-03

The suspected China-linked threat actor known as Warlock is still continuing to weaponize Microsoft SharePoint vulnerabilities, likely both old and new, in attacks targeting organizations in Portuguese- and Spanish-speaking countries. The activity, observed by the Symantec and Carbon Black Threat Hunter Team, has hit critical infrastructure, government, and education organizations. ### What Is Warlock Up To? Warlock isn't just exploiting one flaw. They're mixing old and new SharePoint vulnerabilities to break in. Once inside, they disable security tools and deploy ransomware. It's a double whammy: first they blind your defenses, then they lock your data. The attacks have primarily targeted organizations in Portuguese- and Spanish-speaking countries. But don't think you're safe just because you're in the US. Cyber threats don't respect borders. The techniques used here could easily be adapted for other regions. ### Why SharePoint? SharePoint is a juicy target. It's widely used for collaboration and document sharing, often containing sensitive information. If an attacker can exploit a vulnerability, they get a foothold in the network. From there, they can move laterally, escalate privileges, and cause havoc. Warlock seems to be leveraging both known and unknown vulnerabilities. That means even if you've patched everything you know about, there might be a zero-day waiting to be exploited. ### The Ransomware Connection Ransomware is the endgame here. After disabling security tools, Warlock deploys ransomware to encrypt files and demand payment. This combo is particularly nasty because it leaves organizations with little recourse. Backups might be compromised if the attackers have enough time. ### What Can You Do? First, patch, patch, patch. Make sure all your SharePoint instances are up to date. But since zero-days exist, you need defense in depth. Here are some steps: - **Segment your network**: Don't let attackers move freely. Limit access to critical systems. - **Monitor for unusual activity**: Look for signs of lateral movement or attempts to disable security tools. - **Backup offline**: Keep backups disconnected from the network so ransomware can't reach them. - **Educate your team**: Phishing is often the initial vector. Train employees to spot suspicious emails. ### The Bigger Picture Warlock's activities are part of a larger trend: nation-state actors are increasingly using ransomware as a cover or a weapon. The lines between cybercrime and espionage are blurring. As Symantec and Carbon Black noted, "In the..." (the quote was cut off, but you get the idea). The threat is real and ongoing. ### Stay Vigilant If you're in the US, don't assume you're immune. These attackers go where the money is. And with remote work and cloud adoption, the attack surface has never been larger. Keep an eye on advisories from security firms and government agencies. And remember, security is a journey, not a destination. Stay safe out there.