Chinese hackers use Warlock ransomware in SharePoint attacks

A Chinese hacking group has used Warlock ransomware to target organizations serving essential services in Portuguese- and Spanish-speaking regions across Europe, Africa, and Latin America. Symantec reports the group exploited Microsoft SharePoint vulnerabilities to compromise water utilities, telecoms, a university, and a regional government. In at least one case, the hackers disabled security software on dozens of systems before deploying ransomware, indicating a methodical approach.

• Warlock ransomware linked to China-based hacking group
• Attacks focused on Portuguese, Spanish-speaking regions
• Victims include water, telecom, education, and local government
• Hackers exploited multiple SharePoint security flaws
• Attackers disabled security defenses before ransomware launch