[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2sZGa_99LGnx00QafvD5o6BE2MHQ3njkQdvurpLRYms":3},{"article":4,"iocs":54,"watch_terms":59,"solutions":60,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"a9fe9fba-edb9-4d5c-88ff-26006f9f2a6d","Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware","warlock-exploits-sharepoint-flaws-to-disable-security-tools-and-deploy-ransomwar-d5d7c3","The suspected China-linked threat actor known as Warlock is still continuing to weaponize Microsoft SharePoint vulnerabilities, likely both old and new, in attacks targeting organizations in Portuguese- and Spanish-speaking countries. The activity, observed by the Symantec and Carbon Black Threat Hunter Team, has hit critical infrastructure, government, and education organizations. \"In the","The China-linked threat actor Warlock continues to exploit Microsoft SharePoint vulnerabilities to target organizations in Portuguese- and Spanish-speaking countries. The group, also known as Gold Salem and Longlegs, has recently targeted critical infrastructure, government, and education sectors, deploying ransomware after disabling security tools using legitimate drivers and LotL techniques.","Warlock exploits SharePoint flaws to deploy ransomware and disable security tools.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fwarlock-exploits-sharepoint-flaws-to.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjCZSaqs29yWFrct8zgOikM9e4CS0xuAXppzGJ1tskKpKC2gbGuITsYlHYNcnXDMvrFpPuAVS_ZlyEF8Obp7Mgw7CUXe4UsKP3pNEvZWNfszKQVxogslYpoWBZG-QQbEvmS6SDcbgVtXiFFGIEjreD_HSkCYZTfcwL1Rt90qDbbPj946SbMX0FR5CEKRt_H\u002Fs1600\u002Fsharepoint-ransomware.jpg","2026-10-03T14:36:33+00:00","2026-10-03T16:00:11.631976+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"Warlock","threat_actor",{"name":21,"type":19},"Gold Salem",{"name":23,"type":19},"Longlegs",{"name":25,"type":19},"Storm-2603",{"name":27,"type":19},"DragonForce",{"name":29,"type":30},"Microsoft SharePoint","product","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":31,"icon":33,"name":34,"slug":35},null,"Nation-state","nation-state",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[55],{"type":56,"value":57,"context":58},"cve","CVE-2025-1055","Vulnerable driver K7RKScan.sys used to disable security software",[29],{"controls":61,"vendors":145},[62,90,119],{"slug":63,"name":64,"problem":65,"products":66},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[67,75,82],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":63,"product_name":79,"url":80,"description":81},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"slug":91,"name":92,"problem":93,"products":94},"patch-management","Automated patch management","Known holes get closed in days, not months.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":120,"name":121,"problem":122,"products":123},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":141,"product_name":142,"url":143,"description":144},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",[146],{"slug":96,"name":97,"logo_path":98,"roles":147},[148],"affected",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":165},"warlock-exploits-unpatched-sharepoint-to-deploy-ransomware-via-lotl-techniques","Warlock Exploits Unpatched SharePoint to Deploy Ransomware via LotL Techniques","The Warlock threat actor is actively exploiting known Microsoft SharePoint vulnerabilities to gain initial access into organizations, particularly in critical infrastructure, government, and education sectors. Once inside, the group disables security tools using legitimate drivers and Living-off-the-Land (LotL) techniques, making detection significantly harder. This campaign highlights the danger of unpatched internet-facing applications in high-value sectors, where delayed patching creates windows of opportunity for sophisticated, nation-state-linked actors. The use of legitimate system tools to evade defenses underscores that patching alone is insufficient without layered detection and segmentation controls.",[154,155,156,157,158,159,160,161,162,163,164],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 CA-7: Continuous Monitoring","NIST SP 800-53 SC-7: Boundary Protection","NIST CSF ID.VM-1: Asset Vulnerability Identification","NIST CSF PR.PT-4: Communications and Control Networks Protection","ITIL: Change and Release Management (Patch Lifecycle)","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities","GDPR Article 32: Security of Processing (applicable to EU-adjacent organizations)",{}]