Warlock's SharePoint Attacks Are Quietly Disabling Security Tools

Emily Davis · 2026-10-03

### A Threat Actor That Refuses to Go Away Warlock isn't new. But the group's persistence is what's raising eyebrows right now. Security researchers have been tracking this suspected China-linked threat actor for a while, and it keeps finding ways back in. This time, the target is Microsoft SharePoint. Both old and new vulnerabilities are being weaponized, according to findings from the Symantec and Carbon Black Threat Hunter Team. ### Who's Getting Hit The attacks aren't random. They're focused on organizations in Portuguese- and Spanish-speaking countries, which suggests a deliberate regional strategy rather than a scattershot approach. Critical infrastructure, government agencies, and educational institutions are all on the receiving end. These are high-value targets. They hold sensitive data, they often run legacy systems, and they can't afford downtime. That combination makes them prime candidates for ransomware operators who know exactly what they're doing. ### How the Attack Actually Works Here's where it gets interesting. Warlock doesn't just break in and drop ransomware. The group takes a more methodical route. - First, they exploit SharePoint flaws to gain initial access - Then, they work on disabling security tools before deploying anything - Finally, ransomware gets pushed through once defenses are weakened That middle step is the one that should concern IT teams the most. Disabling security software means the organization might not even realize what's happening until it's too late. > "The most dangerous attacker isn't the one who breaks down the door. It's the one who quietly turns off the alarm first." ### Why SharePoint Keeps Showing Up SharePoint is a popular target for a simple reason: it's everywhere. Enterprises rely on it for collaboration, document sharing, and internal communication. It's deeply integrated into workflows. When a vulnerability exists, patching doesn't always happen quickly. Legacy configurations linger. And attackers know this. Warlock appears to be betting on that gap between disclosure and patching. It's a bet that keeps paying off. ### What This Means for Your Organization If you're running SharePoint, now is the time to audit your version and confirm your patches are current. Don't assume your team got to it. Verify. Beyond patching, consider these steps: - Monitor for unusual activity around SharePoint access logs - Ensure endpoint protection can't be silently disabled - Segment critical systems so one breach doesn't open everything - Run regular drills so your team knows what to do when alerts fire ### The Bigger Picture Warlock's campaign is a reminder that ransomware groups are evolving. They're not just smashing windows anymore. They're picking locks, cutting wires, and walking out the front door. Staying ahead means treating security as an ongoing process, not a one-time setup. The organizations that understand this are the ones that recover fastest when something goes wrong.