Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware

According to Symantec and Carbon Black researchers, suspected China-linked threat actor Warlock is exploiting Microsoft SharePoint vulnerabilities to target critical infrastructure, government, and education organizations in Portuguese- and Spanish-speaking countries. The attackers use web shells to steal cryptographic keys and maintain access, abuse legitimate tools for remote connections, and exploit vulnerable drivers to disable security software before deploying ransomware. In one incident, security-disabling tools reached at least 40 hosts within roughly two hours, with ransomware subsequently deployed to at least 33. The findings highlight the continued risk from unpatched or inadequately mitigated SharePoint servers. For more, visit The Hacker News.