Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware

The suspected China-linked actor Warlock is weaponizing Microsoft SharePoint vulnerabilities to disable security tools and deploy ransomware. The activity, observed by Symantec and Carbon Black threat hunters, has hit critical infrastructure, government, and education organizations in Portuguese- and Spanish-speaking countries.