Topic: warlock ransomware
-
Warlock ransomware exploits SharePoint flaws, warns Microsoft
A Chinese hacking group (Storm-2603) is exploiting SharePoint vulnerabilities to deploy Warlock ransomware, targeting over 420 unpatched systems using zero-day exploits like ToolShell. The attackers use Mimikatz and PsExec to steal credentials and move laterally, with at least 400 systems and 148...
Read More » -
Ransomware Attacks Target Vulnerable SharePoint Servers
Chinese-linked threat actors are exploiting critical SharePoint vulnerabilities (CVE-2025-53770 and CVE-2025-53771) to deploy Warlock ransomware, targeting over 400 organizations, including US federal agencies. Suspected Chinese hacking groups Storm-2603, Linen Typhoon, and Violet Typhoon are usi...
Read More » -
Ransomware Hackers Weaponize Velociraptor DFIR Tool
Malicious actors are misusing the Velociraptor digital forensics tool to deploy LockBit and Babuk ransomware, with the Chinese threat group Storm-2603 identified as responsible. Attackers exploited a privilege escalation vulnerability in Velociraptor to maintain persistent access, using technique...
Read More »