Security51 mOctober 27, 2026, 17:00

Warlock hit four organizations, disabling defenses before ransomware

Researchers linked the China-linked Storm-2603 group behind Warlock ransomware to attacks on at least four organizations across Europe, Africa and Latin America, including a water utility and a telecom provider. Entry came via SharePoint flaws, and attackers disabled security software on roughly 40 hosts within two hours before deploying the payload.

CyberScoop

Open source

Warlock hit four organizations, disabling defenses before ransomware

Victims include a water utility, telecom provider, government body and university
Security tools disabled on ~40 hosts in two hours — one every three minutes
Warlock spread via SYSVOL and reached at least 33 hosts
Initial access used SharePoint flaws, including 2025's ToolShell

#Microsoft#SharePoint#Warlock

Warlock Ransomware Hits Major Spanish, Portuguese Organizations

Security

Warlock ransomware still exploits year-old SharePoint flaws

Security

Warlock ransomware spread via SYSVOL after SharePoint compromise

Security

Warlock hit four organizations, disabling defenses before ransomware

Warlock Ransomware Hits Major Spanish, Portuguese Organizations

Warlock ransomware still exploits year-old SharePoint flaws

Warlock ransomware spread via SYSVOL after SharePoint compromise

Sophos: South African organizations under pressure from ransomware