Chinese Hackers Target Critical Infrastructure with Warlock Ransomware via SharePoint Flaws A Chinese cyber threat group is actively deploying Warlock ransomware against critical infrastructure organizations in Portuguese- and Spanish-speaking countries, exploiting unpatched Microsoft SharePoint vulnerabilities, according to a new report by Symantec’s Threat Hunter Team. Victims include a water utility, telecommunications provider, university, and regional government, spanning Europe, Africa, and Latin America. The attacks, ongoing since at least 2025 and continuing into 2026, leverage both older and newly disclosed SharePoint flaws some of which were highlighted by the U.S. government in recent advisories. Researchers suggest the targeting may be opportunistic, driven by exposed, unpatched SharePoint servers, or deliberate, given the focus on critical infrastructure. In one case, attackers used a tool to disable security software on dozens of systems before deploying ransomware. They also conducted extensive reconnaissance, blending malicious activity with legitimate administrative traffic to evade detection. The campaign underscores the risks of unpatched SharePoint deployments, a high-value target due to its role in storing confidential documents and its integration with Microsoft authentication services. Successful breaches could allow attackers to deepen network access, posing significant operational and security risks. This follows a 2025 global surge in SharePoint attacks, which compromised 400+ governments and businesses, including the National Nuclear Security Administration, National Institutes of Health, and Department of Homeland Security. In August 2025, Swiss government institutions were also breached via similar vulnerabilities. While Microsoft previously linked the group to LockBit ransomware before its shift to Warlock, it has not formally tied the actors to known Chinese state-backed groups. Warlock has been used in attacks across the U.S., Russia, Brazil, India, Taiwan, and Japan, signaling a broad and evolving threat.