China-Linked Threat Group Warlock Exploits SharePoint Flaws to Deploy Ransomware in Iberian‑Language Targets

Security researchers have identified ongoing ransomware campaigns attributed to the China‑affiliated actor known as Warlock, which continue to leverage vulnerabilities in Microsoft SharePoint to infiltrate organizations across Portuguese‑ and Spanish‑speaking regions. The campaigns, tracked by Symantec and corroborated by other industry observers, demonstrate the group’s sustained focus on both legacy and newly discovered SharePoint weaknesses.

Warlock’s methodology involves exploiting unpatched SharePoint components to bypass traditional security controls, effectively disabling endpoint protection and other defensive tools before delivering ransomware payloads. By compromising SharePoint—a platform widely used for document collaboration and storage—the group gains a foothold within corporate networks that often lack rigorous segmentation, allowing rapid lateral movement.

The recent activity underscores a broader trend of threat actors weaponizing web‑application flaws to facilitate ransomware attacks. While Microsoft has issued multiple patches for SharePoint over the past years, the persistence of vulnerable installations—particularly in smaller enterprises and public sector entities—provides a fertile environment for groups like Warlock. Analysts note that the use of both older and freshly discovered exploits suggests a comprehensive exploitation kit that can adapt to varying patch levels.

Targeting organizations in Portuguese‑ and Spanish‑speaking countries appears to be a strategic choice, likely driven by the region’s high adoption of Microsoft 365 services combined with uneven patch management practices. The attacks have resulted in encrypted data, operational disruption, and ransom demands, though specific financial impacts have not been disclosed publicly. Symantec’s observations indicate that the ransomware payloads are delivered after the initial foothold is established, following a pattern that mirrors earlier Warlock operations observed in other parts of the world.

Experts advise entities using SharePoint to prioritize timely application of Microsoft security updates, conduct regular configuration reviews, and implement network segmentation to limit the reach of any compromised service. Enhanced monitoring for anomalous SharePoint activity, coupled with robust backup strategies, can also mitigate the fallout from a successful intrusion. As threat actors continue to refine their exploitation chains, the cybersecurity community stresses that proactive defense—rather than reactive response—remains the most effective line of protection against evolving ransomware threats.