> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# 'Warlock' ransomware used in attacks on critical infrastructure in Portuguese, Spanish-speaking countries
- URL: https://f4n6.co.uk/security-feed/warlock-ransomware-used-in-attacks-on-critical-infrastructure-in-portuguese-spanish-speaking-countries/
- Published: 2026-10-02T22:57:20.000Z
- Updated: 2026-10-02T22:57:20.000Z
- Author: Jeff Davies
- Tags: #security-feed, Warlock

## 1\. Executive summary

A China-based group tracked as "Warlock" is using a ransomware strain of the same name against critical infrastructure in Portuguese- and Spanish-speaking countries, exploiting Microsoft SharePoint vulnerabilities for initial access, according to a Symantec Threat Hunter Team report relayed by The Record and SecurityWeek. Confirmed victims named by Symantec include a water utility, a telecommunications provider, a university and a regional government, across Europe, Africa and Latin America. The group has exploited SharePoint since July 2025 and has continued into 2026, adding newer SharePoint bugs flagged by CISA. No CVE identifiers, CVSS scores or exploitation states are present in the source material, and no MITRE ATT&CK profile exists for "Warlock" in our reference data, so the attribution to a Chinese state nexus is single-sourced and unconfirmed. For EMEA financial services the exposure is indirect but real: any internet-facing SharePoint estate that is unpatched against the 2025 or 2026 SharePoint bugs is a candidate entry point, and the group has demonstrated a tool that disables security software across dozens of hosts before ransomware deployment.

## 2\. Regulatory framing

| Article            | Trigger (the fact in this item)                                                                                                                                                                                             | Practical impact                                                                                                                                                                                                     |
| ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 17       | A ransomware operator is exploiting SharePoint, a service the source describes as deeply integrated with Microsoft authentication, and has run a tool that disabled security software on dozens of hosts before encryption. | The incident management process must cover a SharePoint-originating intrusion that reaches endpoint security tooling, not just a perimeter event.                                                                    |
| DORA Art. 19       | Confirmed victims include a water utility, a telecoms provider, a university and a regional government, and the group targets critical infrastructure.                                                                      | If a client is hit through the same SharePoint vector, the major-incident reporting clock to competent authorities starts from classification, so the SharePoint entry point must be captured in the initial report. |
| NIS2 Art. 21(2)(d) | The entry point is a third-party productivity platform (SharePoint) whose patch state the client controls, and the group is selecting victims by exposed, vulnerable SharePoint servers.                                    | Supply chain security measures must extend to the client's own exposed SharePoint deployments and the patch cadence applied to them.                                                                                 |

No CVE identifiers, CVSS scores or CISA KEV entries are present in the source material, so no vulnerability-specific exploitation state can be cited. The 2026 SharePoint bugs referenced by the source are described only as "recently spotlighted by the U.S. government"; the specific identifiers are not given.

## 3\. Technical analysis & attack chain

The source material describes the campaign at the level of victimology and tooling, not at the level of individual CVE exploitation. The confirmed steps are:

1. Initial access via exploitation of Microsoft SharePoint vulnerabilities. Symantec states the group has been exploiting SharePoint since July 2025 and that the 2026 attacks include newer SharePoint bugs. The 2025 cluster is referred to by the colloquial name "ToolShell."
2. Reconnaissance on compromised systems. Symantec reports extensive reconnaissance after the SharePoint foothold.
3. Installation of a toolset designed to blend into normal traffic from developer or administrator workstations.
4. Use of a tool built to disable security software on dozens of hosts.
5. Deployment of the Warlock ransomware.

The source does not name the specific SharePoint CVEs, the vulnerable SharePoint versions, the exploited endpoints or parameters, the security-software-disabling tool, the blending toolset, any command-and-control infrastructure, any persistence mechanism, or any exfiltration channel. Those gaps are material: a defender cannot build a SharePoint-specific detection from this advisory alone and should treat the CISA advisory referenced by the source as the authoritative technical source for the 2026 SharePoint bugs.

What the source does establish about targeting: victims are in Portuguese- and Spanish-speaking countries, across Europe, Africa and Latin America, and include a water utility, a telecommunications provider, a university and a regional government. Symantec assesses the geographic focus as either opportunistic, driven by exposed vulnerable SharePoint servers, or deliberate tasking; the source presents both possibilities without choosing between them. Warlock had previously been used against organizations in the U.S., Russia, Brazil, India, Taiwan and Japan.

On attribution: the source describes the group as China-based and notes that Microsoft could not tie it to any other Chinese state-backed group it tracks, and that the group used a LockBit strain before switching to Warlock. Dark Reading characterises the actor as looking like a cybercrime gang while acting like a state-associated APT. Our reference data holds no MITRE ATT&CK profile for "Warlock," so the state-nexus attribution is unconfirmed and rests on vendor reporting alone.

Confidence caveat: the entire technical picture above is single-sourced to the Symantec Threat Hunter Team report as relayed by The Record, SecurityWeek and Dark Reading. No independent corroboration of the tooling, the victim set, or the attribution is present in the material supplied. Verify before acting on any specific claim.

## 4\. Mitigation & containment

P1 within 24h

- Inventory every internet-facing SharePoint deployment and confirm its patch level against both the 2025 "ToolShell" cluster and the 2026 SharePoint bugs. The source does not supply CVE identifiers; obtain them from the CISA advisory referenced by the source and patch to the vendor-fixed build.
- Where a SharePoint server cannot be patched immediately, restrict access to it at the network edge to known administrative source ranges and remove anonymous or unauthenticated access paths.
- Hunt for the security-software-disabling behaviour: review EDR and antivirus telemetry for hosts where protection was stopped, uninstalled or tampered with, and treat any host showing that pattern alongside SharePoint web-server activity as a P1 containment case. Isolate on confirmation.
- Search for the Warlock ransomware binary and any ransom note on endpoints and file shares; the source gives no filename, extension or note text, so hunt on ransomware behaviour (mass file rename and encryption) rather than on a known artefact.

P2 within 72h

- Review SharePoint web-server and IIS logs for post-exploitation reconnaissance activity, particularly requests originating from hosts that also show developer or administrator workstation traffic patterns, which the source identifies as the group's blending technique.
- Restrict or monitor outbound traffic from SharePoint servers. SharePoint should not be initiating arbitrary outbound connections; the source does not name C2 infrastructure, so baseline the servers and alert on deviation.
- Confirm that backups of SharePoint content and dependent document stores are offline or immutable and that restore has been tested. The source gives no recovery detail; this is a standard control against the encryption step.

P3 within 7 days

- Add the SharePoint estate to the third-party and exposure review under the client's supply chain security measures, covering patch cadence and the time between vendor release and deployment.
- Rehearse the incident management process against a SharePoint-originating intrusion that reaches endpoint security tooling, so the classification and reporting steps in §2 are exercised before they are needed.

## 5\. Indicators of compromise

No indicators of compromise available in the source material. The sources name no hashes, domains, IP addresses, file paths, registry keys, mutexes or scheduled-task names.

The sources do describe observable behaviours. These are listed below as behavioural indicators; they are not atomic and must not be placed in a machine-pivotable block.

| Behaviour                                                                    | Where to observe                                      | Confidence                                             |
| ---------------------------------------------------------------------------- | ----------------------------------------------------- | ------------------------------------------------------ |
| Exploitation of Microsoft SharePoint for initial access                      | SharePoint/IIS web logs, SharePoint ULS logs          | Single-sourced (Symantec via The Record, SecurityWeek) |
| Extensive reconnaissance on compromised systems                              | Endpoint process telemetry, SharePoint server logs    | Single-sourced                                         |
| Tools installed to blend into developer or administrator workstation traffic | Endpoint process and network telemetry                | Single-sourced                                         |
| A tool that disables security software across dozens of hosts                | EDR/AV tamper alerts, endpoint service state          | Single-sourced                                         |
| Warlock ransomware deployment                                                | Endpoint file-system telemetry, file-share monitoring | Single-sourced                                         |

## 6\. Detection

Insufficient indicators to author detection rules. The sources supply no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, ransom-note text or hard-coded values. The only named artefacts are the actor name "Warlock," the ransomware strain name, the colloquial "ToolShell" label and the product name SharePoint; none of these are artefacts of the threat itself, and a rule built on them would detect reporting about the campaign rather than the campaign. Detection should instead be built from the CISA advisory referenced by the source, which the source states covers the six 2026 SharePoint vulnerabilities.

## 7\. Sources

- Jonathan Greig, The Record (Recorded Future News), "'Warlock' ransomware used in attacks on critical infrastructure in Portuguese, Spanish-speaking countries," https://therecord.media/warlock-ransomware-used-in-critical-infrastructure-attacks, 2026-10-02.
- Dark Reading, "Warlock Ransomware Hits Large Spanish, Portuguese Orgs," https://www.darkreading.com/cyberattacks-data-breaches/warlock-ransomware-spanish-portuguese.
- SecurityWeek, "Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks," https://www.securityweek.com/warlock-expands-sharepoint-exploitation-in-critical-infrastructure-attacks/.

All three sources relay the same underlying Symantec Threat Hunter Team report. They are not independent corroboration of its findings.

## 8\. Adverse Trace position

We assess the technical detail in this item as thin and single-sourced: the campaign is real enough to act on, but the source material gives no CVE identifiers, no CVSS scores, no CISA KEV exploitation state, no IOCs and no detection artefacts, so we cannot assign a vulnerability severity and we do not treat the China state-nexus attribution as confirmed, because our reference data holds no MITRE ATT&CK profile for "Warlock." The client impact for EMEA financial services is concentrated in unpatched internet-facing SharePoint, which the source identifies as the entry point and which the group is selecting for; the security-software-disabling step means endpoint protection alone will not stop the encryption stage. We will pull the CISA advisory on the six 2026 SharePoint vulnerabilities and the Microsoft advisories for the 2025 "ToolShell" cluster, map the specific CVEs and fixed builds into a follow-up note, and issue a detection update if any vendor publishes atomic indicators. Clients running internet-facing SharePoint should treat the P1 items in §4 as live now and confirm patch state before close of business.

---

[Read the original source →](https://therecord.media/warlock-ransomware-used-in-critical-infrastructure-attacks?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*