Act
active
Warlock APT Exploits SharePoint Vulns to Kill Security Tools, Drop Ransomware
- Engineer — Act: Warlock is actively weaponizing both old and new SharePoint vulnerabilities to disable endpoint defenses and deploy ransomware; patch SharePoint to the latest available version immediately and audit recent access logs for exploitation artifacts.
- SOC/IR — Act: Two-vendor corroboration (Symantec and Carbon Black) of live ransomware deployments via SharePoint exploitation warrants a retroactive hunt for security-tool-kill events and SharePoint lateral movement patterns since at least early Q4 2026.
- Leader — Plan: Confirm SharePoint patch compliance with engineering this quarter and validate that endpoint-defense controls can detect tampering; current targeting is concentrated in Portuguese- and Spanish-speaking critical infrastructure, but the TTPs are sector-portable.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.