Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware

The Warlock threat actor, believed to be linked to China, is exploiting vulnerabilities in Microsoft SharePoint to attack organizations in countries where Portuguese and Spanish are spoken. The attacks have targeted critical infrastructure, government, and education sectors. The threat actor's activity has been observed by the Symantec and Carbon Black Threat Hunter Team. Warlock is using the exploited vulnerabilities to disable security tools and deploy ransomware. The attacks likely involve both old and new SharePoint vulnerabilities.