As reported by cyberscoop, the China-linked threat group known as Storm-2603, which operates the Warlock ransomware, has launched a series of targeted attacks against at least four organizations across Europe, Africa and Latin America.
The attackers primarily exploited on-premises Microsoft SharePoint vulnerabilities to gain initial access. Once inside, the group demonstrated a methodical approach, spending nine days mapping the domain and establishing covert remote access. The operation culminated in a rapid deployment phase where the attackers systematically disabled security software across 40 hosts within two hours before deploying ransomware. The victims included a water utility, a telecommunications provider, a regional government body and a university. Security experts emphasize that these incidents highlight a critical vulnerability in security budgets: the reliance on detection tools that adversaries can easily disable. By targeting the security sensors themselves, the Warlock operators effectively blinded the organizations before executing their payload. Industry analysts suggest that organizations, particularly critical infrastructure providers, must shift toward security controls that operate independently on the machine rather than relying solely on cloud-connected sensors or human intervention. This strategy aims to prevent attackers from gaining the necessary administrative rights to neutralize defensive measures, thereby reducing the risk of catastrophic system-wide compromises.
Source: cyberscoop
