Warlock Ransomware Hits Large Spanish, Portuguese Orgs

A sophisticated actor known as Warlock (Microsoft: Storm-2603) has been conducting targeted ransomware campaigns using SharePoint zero-day exploits (ToolShell and similar), DLL sideloading, a signed vulnerable driver, VS Code remote tunneling, and staging payloads in SYSVOL to leverage AD replication—targeting high-value organizations in Spanish- and Portuguese-speaking regions and blurring lines between APT behavior and criminal ransomware operations.