Warlock Ransomware Campaign Targets Critical Infrastructure
A Chinese-linked threat actor is conducting ransomware attacks against critical infrastructure organizations in Portuguese- and Spanish-speaking countries using a malware strain known as Warlock, according to a new report from the Symantec Threat Hunter Team. The victims identified in the campaign include a water utility, a telecommunications provider, a university and a regional government, with organizations located across Europe, Africa and Latin America.
The attackers are exploiting a series of vulnerabilities in Microsoft SharePoint, including flaws previously disclosed in 2025 and newer vulnerabilities highlighted by the U.S. government in 2026. Symantec researchers noted that the continued success of these intrusions demonstrates that many organizations remain unpatched against both older and recently disclosed SharePoint security issues.
Exploitation of SharePoint Vulnerabilities Enables Network Penetration
The campaign builds on earlier warnings from Microsoft, which last year attributed attacks using Warlock ransomware to China-based hackers targeting SharePoint flaws colloquially referred to as "ToolShell." Symantec’s findings confirm that these intrusions have persisted into 2026 and now incorporate exploitation of additional SharePoint vulnerabilities recently flagged by U.S. authorities.
In one observed incident, the attackers deployed a specialized tool designed to disable security software on dozens of compromised hosts before initiating the Warlock ransomware payload. Prior to ransomware deployment, the threat actors conducted extensive reconnaissance on victim networks, installing utilities intended to mimic legitimate administrative or developer traffic to evade detection.
Broader Context of SharePoint as a High-Value Target
The Symantec report was released approximately one month after the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an alert warning that threat actors are actively exploiting six newly discovered SharePoint vulnerabilities that grant extensive access to compromised environments. SharePoint remains an attractive target for both financially motivated cybercriminals and state-sponsored espionage groups due to its role in storing sensitive documents and its deep integration with Microsoft’s authentication infrastructure.
A successful breach of SharePoint can allow attackers to move laterally within a victim’s network, potentially accessing domain controllers, email systems and other critical resources. This pattern was evident in previous waves of SharePoint-focused attacks, which in the prior year led to alleged breaches at over 400 governments and businesses worldwide, including high-profile U.S. federal agencies such as the National Nuclear Security Administration, the National Institutes of Health and the Department of Homeland Security.
Additional incidents linked to SharePoint exploitation include compromises of several Swiss government institutions in August, further underscoring the global scope of the threat.
Warlock Ransomware Evolution and Attribution Challenges
Microsoft previously stated that it could not definitively link the group behind Warlock ransomware to any specific Chinese state-sponsored threat cluster it monitors, although investigators observed that the actors had previously used a variant of the LockBit ransomware before transitioning to Warlock. Historical deployment of Warlock has been observed against targets in the United States, Russia, Brazil, India, Taiwan and Japan.
Symantec researchers concluded that the recent concentration of attacks on Portuguese- and Spanish-speaking regions may reflect either opportunistic exploitation of exposed, vulnerable SharePoint instances in those areas or a more deliberate operational focus by the threat actors. They emphasized that the victimization of essential service providers highlights the tangible real-world risks posed by ransomware when it disrupts critical infrastructure operations.
Source: The Record