China-linked Warlock ransomware exploits SharePoint to infiltrate water, telecom and academic networks

A ransomware gang identified as Warlock, which is believed to operate out of China, has been linked to a series of recent intrusions that compromised a municipal water utility, a major telecommunications provider, a regional government agency and a university. The attackers gained footholds by leveraging known vulnerabilities in Microsoft SharePoint, a collaboration platform widely used for document management and internal communications.

According to security analyst reports first published by BleepingComputer, the group employed a multi‑stage approach: they first scanned public‑facing SharePoint sites for unpatched flaws, then used crafted web requests to execute code on the servers. Once inside, the threat actors moved laterally, harvesting credentials and deploying the Warlock ransomware payload, which encrypts data and demands payment for decryption keys.

The water utility, which serves tens of thousands of residents, experienced a temporary shutdown of its billing and customer‑service portals. While the physical delivery of water was not affected, the incident forced the organization to revert to manual processes and raised concerns about the potential for sabotage of critical infrastructure. The telecom operator reported service disruptions in its internal email system and a brief outage of some customer‑facing portals, prompting the company to issue an advisory to its corporate clients.

Officials at the regional government body confirmed that confidential documents were encrypted, but they declined to disclose whether any data was exfiltrated before encryption. The university, which hosts research data and student records, faced a similar encryption event; its IT department isolated the affected SharePoint servers and began a recovery effort using offline backups.

SharePoint has long been a target for cybercriminals because many organizations expose the service to the internet for remote collaboration, sometimes without applying the latest security patches. Microsoft has released multiple advisories urging administrators to apply critical updates and to enforce strict access controls, yet the persistence of these vulnerabilities suggests gaps in patch management practices across sectors.

Cybersecurity experts note that the Warlock group’s focus on essential services aligns with a broader trend of ransomware operators seeking higher ransom payouts by exploiting the urgency of restoring critical operations. The attacks also underscore the growing intersection between ransomware and nation‑state actors, as the group’s alleged ties to China raise geopolitical questions about attribution and response.

In the wake of the incidents, the affected organizations are working with law enforcement and third‑party incident‑response teams to assess damage, restore services and harden defenses. Industry bodies are urging a coordinated effort to improve SharePoint security, including regular vulnerability scanning, zero‑trust network segmentation and employee training on phishing and credential‑theft tactics.

As investigations continue, the broader community watches closely for any indication that Warlock may target additional sectors. Analysts warn that without swift remediation of known SharePoint flaws, similar ransomware campaigns could recur, threatening both public utilities and private enterprises alike.