> ## Content Index
> Fetch the complete content index at: https://cylumina.ghost.io/llms.txt
> Use this file to discover other available public pages before exploring further.

# Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
- URL: https://cylumina.ghost.io/warlock-exploits-sharepoint-flaws-to-disable-security-tools-and-deploy-ransomware/
- Published: 2026-10-05T08:43:17.000Z
- Updated: 2026-10-05T08:43:17.000Z
- Author: 9ino

According to Symantec and Carbon Black researchers, suspected China-linked threat actor Warlock is exploiting Microsoft SharePoint vulnerabilities to target critical infrastructure, government, and education organizations in Portuguese- and Spanish-speaking countries. The attackers use web shells to steal cryptographic keys and maintain access, abuse legitimate tools for remote connections, and exploit vulnerable drivers to disable security software before deploying ransomware. In one incident, security-disabling tools reached at least 40 hosts within roughly two hours, with ransomware subsequently deployed to at least 33\. The findings highlight the continued risk from unpatched or inadequately mitigated SharePoint servers. For more, visit [The Hacker News](https://thehackernews.com/2026/10/warlock-exploits-sharepoint-flaws-to.html?ref=cylumina.ghost.io).