'Warlock' ransomware used in attacks on critical infrastructure in Portuguese, Spanish-speaking countries

Symantec reports that a China-linked group is actively exploiting multiple Microsoft SharePoint vulnerabilities (including 2025 and 2026 bugs) to deploy the Warlock ransomware against critical infrastructure and other organizations across Europe, Africa and Latin America; attackers perform extensive reconnaissance, disable security software on dozens of hosts, and focus recently on Portuguese- and Spanish-speaking countries, highlighting unpatched SharePoint instances as a high-risk attack surface.