Palo Alto Networks investigating ransomware threat related to SharePoint exploitation

Palo Alto Networks is investigating a ransomware incident tied to recently disclosed ToolShell vulnerabilities in Microsoft SharePoint, where attackers claimed to have encrypted files with the 4L4MD4R ransomware and threatened deletion if decryption was attempted; researchers note the intruders used PowerShell to disable Windows Defender real-time monitoring and bypassed certificate validation. (Source: Cybersecurity Dive, Unit 42 tweet)