As cited
Copy frozen at (site build).
ransomware
What happens when security tools go dark before the ransomware
The China-linked Warlock ransomware group targeted at least four organizations across Portugal, Spain, and Latin America by exploiting on-premises Microsoft SharePoint vulnerabilities, including a flaw patched in July 2025. During one attack on critical infrastructure, the group disabled security software across 40 hosts within two hours before deploying the ransomware, demonstrating that detection tools lose value when adversaries can switch them off. The article argues that security budgets must distinguish between protections dependent on sensors and human response versus controls that operate on the machine without external dependencies.
Why it matters: Water utilities, telecommunications providers, regional governments, and universities in multiple regions face active Warlock attacks through unpatched SharePoint; operators must prioritize patching and test whether their endpoint detection capabilities survive adversary disabling tactics, since 81% of U.S. water systems are small with limited security staff to monitor alerts around the clock.
- Source published
- First seen by Cybersecurity Tracker