Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks

A China-based hacking group known as Warlock has been exploiting vulnerabilities in SharePoint since July 2025. This exploitation is part of the group's attacks on critical infrastructure. Warlock's activities have been expanding to include these SharePoint vulnerabilities. The group's focus on critical infrastructure suggests a targeted approach to their attacks. Warlock's exploitation of SharePoint is a notable aspect of their operations. The group's activities are a concern due to their potential impact on critical systems.