Skip to content
Warlock Ransomware Group Targets Global Infrastructure via SharePoint Exploits

Warlock Ransomware Group Targets Global Infrastructure via SharePoint Exploits

First seen 28 Oct 2026, 00:46 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 02:46 UTC
  • •Warlock ransomware group exploited SharePoint vulnerabilities in multiple regions.
  • •Attackers disabled security software on 40 hosts within two hours before deploying ransomware.
  • •Organizations are urged to adopt independent security controls to prevent similar attacks.

The China-linked Warlock ransomware group, tracked as Storm-2603, has targeted at least four organizations in Europe, Africa, and Latin America, including a water utility and a telecommunications provider. The attackers exploited vulnerabilities in on-premises Microsoft SharePoint to gain initial access. Over a nine-day period, they mapped the domain and established covert remote access before disabling security software on 40 hosts in just two hours. The ransomware was deployed shortly after the security tools were disabled. This incident highlights a critical vulnerability in security budgets, as adversaries can easily disable detection tools. Security experts recommend that organizations implement independent security controls to mitigate risks. The ongoing threat emphasizes the need for robust patching and endpoint detection measures.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-01
Warlock ransomware attacks reported
Threat researchers reported attacks by the Warlock group on four organizations, including critical infrastructure.
Cyberscoop

More articles in this cluster (2)

Following this threat?

Track Warlock and Storm-2603 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (11)

1 / 3

Common questions

What organizations were affected?
The affected organizations include a water utility, a telecommunications provider, a regional government body, and a university.
How did the attackers gain access?
The attackers exploited vulnerabilities in on-premises Microsoft SharePoint to gain initial access.
What should organizations do to protect themselves?
Organizations should implement independent security controls and ensure robust patching and endpoint detection measures are in place.