China-linked group Warlock exploits SharePoint flaws to deploy ransomware

The Hacker News reported that a threat group known as Warlock is continuing to exploit vulnerabilities in Microsoft SharePoint. The group, which is suspected of having links to China, targets organizations located in Portuguese-speaking and Spanish-speaking countries. [1]

According to the Hacker News, the attackers are likely using both old and new SharePoint security flaws. During the intrusions, Warlock disables security tools installed on the systems before deploying ransomware across the compromised networks. [1]

Wikipedia describes ransomware as malware that takes private data hostage until a ransom is paid. This form of extortion can involve encrypting files or exfiltrating data with threats to release it publicly. Attackers usually demand payments through cryptocurrency or stored-value cards, which are harder to trace and complicate prosecution. In some cases, victims can recover original files without paying if the software contains implementation mistakes, lacks encryption, or if cryptographic keys leak. [4]

Computer security is defined by Wikipedia as a field that focuses on protecting software, systems, and networks from threats. These threats can lead to data theft, hardware damage, or service disruption. Security tools are designed to block unauthorized access, but malicious actors seek to disable them during cyberattacks. [3]