'Warlock' ransomware used in attacks on critical infrastructure in Portuguese, Spanish-speaking countries

{
  "signal_id": "87b05972-898a-8cb5-b795-5ff45d23dd83",
  "signal_type": "news",
  "signal_subtype": "security_incident",
  "detected_at": "2026-10-02T14:05:00+00:00",
  "company": {
    "name": "Microsoft",
    "domain": "microsoft.com"
  },
  "data": {
    "url": "https://therecord.media/warlock-ransomware-used-in-critical-infrastructure-attacks",
    "title": "'Warlock' ransomware used in attacks on critical infrastructure in Portuguese, Spanish-speaking countries",
    "excerpt": "Critical infrastructure organizations in Portuguese- and Spanish-speaking countries are being attacked by a Chinese group using a ransomware strain called Warlock. The group is exploiting a variety of vulnerabilities impacting Microsoft SharePoint, according to a new report from Symantec Threat Hunter Team. Symantec researchers said the victims include a water utility, a telecommunications provider, a university and a regional government. The organizations are located across Europe, Africa and Latin America. Last year, Microsoft warned that China-based hackers using the Warlock ransomware were focusing their attacks on SharePoint vulnerabilities colloquially named “ToolShell.” Symantec found that the attacks have continued into 2026 and now include newer SharePoint vulnerabilities recently spotlighted by the U.S. government. The campaign illustrated that hackers are still finding success in exploiting SharePoint deployments that have not been patched either for the 2025 vulnerabilities or the 2026 bugs. “The apparent recent focus on Portuguese- and Spanish-speaking countries suggests either an opportunistic targeting pattern driven by exposed, vulnerable SharePoint servers, or a more deliberate tasking,” Symantec researchers said. “The inclusion of critical infrastructure operators among the victims is a reminder of the potential real-world consequences of ransomware attacks...",
    "product": "SharePoint",
    "summary": "Multiple vulnerabilities in Microsoft SharePoint are being exploited by a Chinese hacking group using Warlock ransomware to attack critical infrastructure organizations.",
    "planning": false,
    "image_url": "https://cms.therecord.media/uploads/moshed_10_02_10_8_51_fb7e436dcd.png",
    "confidence": 0.9,
    "product_data": {
      "name": "SharePoint",
      "full_text": "Microsoft SharePoint",
      "fuzzy_match": false
    },
    "product_tags": [
      "online_technology",
      "general_technology",
      "data"
    ],
    "published_at": "2026-10-02T14:05:00Z",
    "vulnerability": "Multiple vulnerabilities, including those colloquially named “ToolShell” and others spotlighted by CISA, are being exploited by a Chinese group using Warlock ransomware.",
    "article_sentence": "The group is exploiting a variety of vulnerabilities impacting Microsoft SharePoint, according to a new report from Symantec Threat Hunter Team."
  }
}

curl https://signals.autobound.ai/v1/signals/87b05972-898a-8cb5-b795-5ff45d23dd83 \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"microsoft.com","limit":20}'