Skip to main content
Back to feed
CyberReportedHighDevelopingFeatured
6.7

China-linked Warlock group expands SharePoint exploitation in critical infrastructure attacks

The China-based threat actor Warlock has been actively exploiting SharePoint vulnerabilities since July 2025, with recent expansion into critical infrastructure sectors. The scope of affected organizations and specific sectors remain unclear, but the campaign signals sustained, targeted cyber espionage against high-value targets.

SecurityWeek3 days agoCN, USengCredibility 25%View source

Score Breakdown

Mosaic Score6.7
Model confidence0.5
Significance0.8
Source credibility0.3

Intelligence Tags

#cyberespionage#sharepoint#critical-infrastructure#warlock#china

Entities

countrycountry
Source

Part of 2 situations

activeGeopoliticsTrade1h ago

China — 122 developments

→ stable·37 signals·CN, EU, BE +10Score 5.0
developingCyber1d ago

China-linked Warlock Group Exploits SharePoint in Critical Infrastructure Attacks

The China-linked Warlock ransomware group is actively exploiting SharePoint vulnerabilities for initial access, confirmed in attacks against a water utility, telecom provider, regional government body, and university. This campaign, ongoing since July 2025, indicates a sustained and expanding cyber espionage effort targeting critical infrastructure and public sector entities. The full scope of affected organizations and data impact remains unclear.

↑ escalating·2 signals·US, CNScore 4.7

Related signals

8 found