Symantec and Carbon Black Threat Hunter Team

Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware

A suspected China-linked threat actor named Warlock is exploiting Microsoft SharePoint vulnerabilities—both known and potentially unknown—to disable security tools and deploy ransomware against critical infrastructure, government, and education organizations in Portuguese- and Spanish-speaking countries.