Warlock Ransomware SharePoint Attacks

By Editorial Team | October 7, 2026
Warlock ransomware SharePoint attacks hit a water utility and a telecom provider. Symantec saw an EDR killer on 40 hosts in two hours. Patch and hunt.

Warlock ransomware SharePoint attacks have reached a water utility, a telecom provider, a regional government body and a university, according to Symantec and Carbon Black. The China-linked group still gets in through on-premises SharePoint, switches off endpoint protection on dozens of machines within about two hours, and then launches ransomware from a share that every…

Read More