Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware

The Warlock threat actor is actively exploiting known Microsoft SharePoint vulnerabilities to gain initial access into organizations, particularly in critical infrastructure, government, and education sectors. Once inside, the group disables security tools using legitimate drivers and Living-off-the-Land (LotL) techniques, making detection significantly harder. This campaign highlights the danger of unpatched internet-facing applications in high-value sectors, where delayed patching creates windows of opportunity for sophisticated, nation-state-linked actors. The use of legitimate system tools to evade defenses underscores that patching alone is insufficient without layered detection and segmentation controls.