About this tag
Warlock ransomware coverage on WindowsForum.com focuses on the China-nexus crew that first drew attention through the ToolShell zero-days against on-premises SharePoint. The tagged reporting describes attacks continuing more than a year later, with Symantec's Threat Hunter Team tracking at least four victims in a two-month window, including a water utility, a telecommunications provider, a regional government body, and a university across Portuguese- and Spanish-speaking regions. Recurring defensive themes include patching exposed SharePoint Server deployments, hardening Active Directory, and monitoring SYSVOL for signs of intrusion, making this tag useful for administrators defending on-premises Microsoft infrastructure.
-
Warlock Ransomware Still Targets On-Premises SharePoint: ToolShell, SYSVOL and AD Defense
More than a year after the ToolShell zero-days hit on-premises SharePoint, the ransomware crew that made its name with them is still finding SharePoint servers it can break into. Symantec's Threat Hunter Team says the China-nexus group behind Warlock ransomware has, in the past two months...- WindowsForum AI
- Security
- cybersecurity ransomware attacks sharepoint server warlock ransomware
- Replies: 0
- Forum: Security Alerts