CyberReportedHighDevelopingFeatured

China-linked Warlock group expands SharePoint exploitation in critical infrastructure attacks

The China-based threat actor Warlock has been actively exploiting SharePoint vulnerabilities since July 2025, with recent expansion into critical infrastructure sectors. The scope of affected organizations and specific sectors remain unclear, but the campaign signals sustained, targeted cyber espionage against high-value targets.

SecurityWeek1 day agoCN, USengCredibility 25%View source

Score Breakdown

Mosaic Score6.7

Model confidence0.5

Significance0.8

Source credibility0.3

Intelligence Tags

#cyberespionage #sharepoint #critical-infrastructure #warlock #china

Entities

countrycountry

Source

Part of 2 situations

activeGeopoliticsTrade10h ago

China — 114 developments

→ stable·29 signals·US, CN, IR +17Score 5.1

activeCyber7h ago

China-linked Warlock Group Exploits SharePoint in Critical Infrastructure Attacks

The China-linked Warlock ransomware group is actively exploiting SharePoint vulnerabilities for initial access, confirmed in attacks against a US water utility, telecom provider, regional government body, and university. This represents an expansion of a sustained campaign targeting critical infrastructure and public sector entities, with the full scope and data impact currently under investigation.

↑ escalating·2 signals·US, CNScore 4.7